Patients of Brown Health Medical Group-MA, including at least 290,357 Massachusetts residents, may be covered by a consolidated proposed class action alleging Lifespan Physician Group of Massachusetts failed to protect personal, financial and health information exposed in a December 2025 file-server breach. No class has been certified and there is nothing to file yet.
Allegations Only · No Settlement Yet
This article describes a class action complaint. The statements below are unproven allegations. Lifespan Physician Group of Massachusetts, Inc. (Brown Health Medical Group-MA) has not admitted wrongdoing and has not been found liable, there is no certified class, and there is nothing to claim at this time. This page is informational. It is not legal advice.
What the Brown Health Lawsuits Are About
Lifespan Physician Group of Massachusetts, Inc., which does business as Brown Health Medical Group-MA, is a non-profit, multi-specialty medical group that provides outpatient care in Massachusetts and the surrounding region. It is part of the Brown University Health system, the Providence-based hospital network formerly known as Lifespan. According to the first complaint filed against it, an unauthorized actor got into one of the group’s file servers between about December 15 and December 16, 2025, and the files on that server held personal, financial and medical information about hundreds of thousands of patients.The complaint says Brown Health reported the breach to Massachusetts as affecting at least 290,357 residents of that state, with more people affected in Rhode Island, Vermont and elsewhere. It alleges that the breach resulted from a failure to maintain reasonable data security and that Brown Health waited about seven months to tell patients.
That first complaint, No. 1:26-cv-00473, was filed on July 21, 2026 in the U.S. District Court for the District of Rhode Island. On August 28, 2026, the court granted a motion to consolidate the related Brown Health breach cases with it, and they now proceed as one case before District Judge Melissa R. DuBose. Brown Health has not admitted wrongdoing, and no court has ruled on whether any of the allegations are true.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
Timeline: From the Server Intrusion to Consolidation
The dates below come from the complaint, which draws on Brown Health’s notice letter, and from the court docket.- December 15–16, 2025 — An unauthorized actor accesses a file server on Brown Health’s network, according to the complaint.
- December 16, 2025 — Brown Health becomes aware of the incident. The complaint says the company isolated the server and notified law enforcement.
- June 22, 2026 — Brown Health determines the scope of the potentially affected information, according to its notice as quoted in the complaint.
- July 16, 2026 — Brown Health’s notice letters are dated and patients begin to be notified, roughly seven months after discovery. The complaint cites a breach notice filed with the Vermont Attorney General the same day.
- July 21, 2026 — The first class action complaint is filed in Rhode Island federal court.
- August 25, 2026 — A motion to consolidate the related cases is filed.
- August 28, 2026 — The court grants consolidation and directs that all pleadings be filed in the lead case, No. 1:26-cv-00473.
What Information Was Involved
Citing Brown Health’s own notice, the complaint lists these categories of information as stored on the affected server and placed at risk:- Names, dates of birth and contact information
- Health insurance information
- Billing, claims and payment information
- Medical information
- For some people: Social Security numbers, driver’s license or other government-issued ID numbers, credit or debit card numbers and financial account information
Brown Health has said that not every category was involved for every person, that it could not conclusively determine exactly what information was affected, and that its electronic health record system was not part of the incident, according to the complaint. HIPAA Journal, describing the notices Brown Health filed with state regulators, reported that the affected categories also included personnel and human resources records. Brown Health offered affected people 24 months of complimentary Experian IdentityWorks credit monitoring and identity restoration services, the complaint says.
Who Is Affected
The complaint puts the Massachusetts count at 290,357 residents, citing the state’s Office of Consumer Affairs and Business Regulation, and cites a Vermont attorney general filing reporting 86 Vermont residents. It says Rhode Island residents and people in other states were also affected but gives no figure for them.A larger total appears on the federal breach portal maintained by the U.S. Department of Health and Human Services’ Office for Civil Rights. HIPAA Journal reported that the portal lists 311,760 individuals whose protected health information was potentially compromised. The complaint itself describes the group as “hundreds of thousands” of people.
What the Complaint Alleges
The complaint’s central claim is that Brown Health did not put in place security measures that federal regulators and standard-setting bodies have long described as basic for a healthcare provider. It points to the HIPAA Security Rule, guidance from HHS and the Federal Trade Commission, and frameworks published by the National Institute of Standards and Technology and the Center for Internet Security. It references HIPAA only as a benchmark for the standard of care, not as a separate claim.On information and belief, the complaint alleges that Brown Health lacked one or more safeguards such as adequate access controls and authentication, network monitoring and intrusion detection, timely patching, encryption of sensitive data at rest, and workforce training, and that those gaps caused the breach. It also alleges that the risk was foreseeable, pointing to years of federal warnings about cyberattacks on healthcare providers and to a 2020 resolution in which, it says, an affiliated Lifespan entity paid $1,040,000 to the HHS Office for Civil Rights over the theft of an unencrypted laptop.
The notice delay is the second main theme. The complaint says Brown Health learned of the incident on or about December 16, 2025 but did not notify people until on or about July 16, 2026, and that the company has not publicly explained the gap. It measures that delay against Rhode Island’s Identity Theft Protection Act, which it says requires notice within 45 calendar days of confirming a breach, Massachusetts’ notice requirement, and the HIPAA Breach Notification Rule’s 60-day outer limit.
The named plaintiff, a Rhode Island patient, alleges she received a notice letter on or about July 20, 2026, later found about $176 in unauthorized charges on her credit card that she attributes to the breach, had to replace the card, and has seen more spam email since. The complaint says patients across the proposed class face an ongoing risk of identity theft, financial fraud and medical identity theft, along with lost time, a lost benefit of the bargain and reduced value of their information.
The Consolidated Case in Rhode Island Federal Court
Brown Health Medical Group-MA is organized under Massachusetts law, but the complaint alleges that its officers and directors run it from Providence, Rhode Island, where its parent, Brown University Health, is headquartered. On that basis, the complaint says the company is a citizen of both states and is at home in Rhode Island, and it asserts federal jurisdiction under the Class Action Fairness Act.The lead case, No. 1:26-cv-00473-MRD-PAS, is assigned to District Judge Melissa R. DuBose, with Magistrate Judge Patricia A. Sullivan. A motion to consolidate the related cases was filed on August 25, 2026, and the court granted it on August 28, 2026. Its text order directs that all pleadings be filed in the lead case going forward.
According to an announcement by one of the plaintiffs’ law firms, Scott J. Falgoust of Bryson Harris Suciu & DeMay PLLC has been appointed interim class counsel to lead the consolidated case for the proposed class. The related docket entries, dated September 28 and October 13, 2026, have no publicly available text, so OCA has not reviewed the appointment order itself.
The Proposed Class
The complaint seeks to represent a nationwide class defined as all individuals residing in the United States whose private information was accessed, potentially accessed, or otherwise compromised as a result of the breach. Excluded are Brown Health and its officers, directors and affiliates, any entity it controls, the presiding judge and the judge’s immediate family and staff, and anyone who opts out. The plaintiff reserves the right to change the definition or add subclasses as the case develops.Class status is requested under Federal Rules of Civil Procedure 23(b)(2), 23(b)(3) and, in the alternative, 23(c)(4), which allows certification of particular issues. No class has been certified, and the definition in the complaint is only a proposal.
Claims and Relief Sought
The complaint brings four counts on behalf of the proposed class:- Negligence
- Breach of implied contract
- Unjust enrichment, pleaded in the alternative to the implied-contract claim
- Declaratory judgment under the federal Declaratory Judgment Act
It asks the court to certify the class and to declare that Brown Health owes ongoing duties to protect the information it still holds and that its current security measures are inadequate. It also asks for an order requiring a list of security improvements, including periodic independent penetration testing, encryption and multifactor authentication, network segmentation and intrusion detection, regular vulnerability scanning and patching, employee security training, deletion of data no longer needed, independent assessments reported to the court, and credit monitoring and identity-theft protection for class members with a way to seek reimbursement of losses traceable to the breach.
On the money side, the complaint seeks actual, compensatory, consequential and nominal damages in an amount to be set at trial, restitution and disgorgement in the alternative, the cost of credit monitoring and identity-theft protection, pre- and post-judgment interest, and attorneys’ fees and costs. It demands a jury trial. No dollar figure is attached to any of it.
What Happens Next
In consolidated data breach cases, the court-appointed lead lawyers for the plaintiffs commonly file a single consolidated complaint that replaces the individual ones. The defendant then typically answers or files a motion to dismiss, and the court decides which claims, if any, move forward. Cases that survive that stage move into discovery and, later, a contested request for class certification.Many data breach class actions end in a negotiated settlement rather than a trial, but that is not a given in any particular case, and some are dismissed. If the Brown Health case settles, the court would have to approve the terms, and people in the class would generally be notified and given a chance to file a claim, object or opt out. None of that has happened here.
Is There Anything to Claim?
There is nothing to claim. The case is at the complaint stage, no class has been certified, and there is no settlement, claim form, settlement website or deadline. The credit monitoring described in Brown Health’s notice letter is the company’s own offer and is separate from the lawsuit.Questions
Is there a Brown Health data breach settlement?
There is no settlement. The proposed class actions over the December 2025 Brown Health Medical Group-MA breach have been consolidated in the U.S. District Court for the District of Rhode Island and are still at the complaint stage. No class has been certified, there is no settlement fund or claim form, and there is nothing to file.
How many people were affected by the Brown Health Medical Group data breach?
The complaint says Brown Health reported at least 290,357 affected Massachusetts residents to that state, along with residents of Rhode Island, Vermont and other states, including 86 Vermont residents. HIPAA Journal reported that the breach portal run by the U.S. Department of Health and Human Services' Office for Civil Rights lists 311,760 individuals in total.
What information was exposed in the Brown Health data breach?
Citing Brown Health's own notice, the complaint says the affected file server held names, dates of birth, contact information, health insurance information, billing, claims and payment information and medical information, and for some people Social Security numbers, driver's license or other government ID numbers, credit or debit card numbers and financial account information. Brown Health has said not every category was involved for every person and that its electronic health record system was not affected.
When did Brown Health notify patients about the breach?
According to the complaint, Brown Health became aware of the incident on or about December 16, 2025 and sent notice letters dated on or about July 16, 2026, about seven months later. The complaint alleges the delay deprived people of a chance to protect themselves sooner and says Brown Health has not publicly explained it.
Why are the Brown Health lawsuits in Rhode Island federal court?
Brown Health Medical Group-MA is a Massachusetts non-profit, but the complaint alleges its officers and directors run it from Providence, the headquarters of its parent, Brown University Health, formerly Lifespan. On that basis the complaint says the company is at home in Rhode Island and that federal court there has jurisdiction under the Class Action Fairness Act.
What does it mean that the Brown Health lawsuits were consolidated?
On August 28, 2026, the court granted a motion to consolidate the related cases and ordered that all pleadings be filed in the lead case, No. 1:26-cv-00473. The cases now move forward together before District Judge Melissa R. DuBose instead of as separate lawsuits. Consolidation is a case-management step; it says nothing about whether the allegations are true.
Sources
• Tarvis v. Lifespan Physician Group of Massachusetts, Inc., No. 1:26-cv-00473 (D.R.I.) — CourtListener docket• Class action complaint, ECF No. 1 (filed July 21, 2026) — PDF via CourtListener RECAP
• HIPAA Journal — “Brown Health Medical Group-MA Data Breach Affects 312,000 Individuals” (August 4, 2026)
