Published
August 25, 2026
This settlement resolves claims over a July 2025 cyberattack on two servers belonging to Modernizing Medicine, the Florida electronic health record software company known as ModMed, in which files containing Social Security numbers, health insurance details and medical records were accessed. If you were sent a notice, you can take a one-time payment estimated at $75 with no documentation at all, or instead claim up to $5,000 in documented losses — and either way you can enroll in two years of medical identity monitoring.
Current Status
Claims are open. The deadline to file is November 2, 2026, online or postmarked. The deadlines to exclude yourself or to object come two weeks earlier, on October 19, 2026. The Court has scheduled a Final Approval Hearing for November 17, 2026 at 2:30 p.m. Eastern Time in West Palm Beach, and the settlement has not been approved yet. No payment date has been announced: the Notice says settlement payments and the activation codes for the monitoring are distributed only if the Court grants final approval and after any appeals are resolved, and that it is not known whether appeals will be filed. If a notice reached you, it carries the LoginID and PIN you need to file online.
Status
Claims Open
final approval hearing November 17, 2026 in West Palm Beach
Claim Deadline
November 2, 2026
online or postmarked · opting out and objecting close earlier, on October 19
Estimated Payout
$75, or up to $5,000
the two cash options are alternatives, not additive · two years of medical data monitoring comes with either
Proof Required
Yes
LoginID and PIN from your notice to file online · the $75 option itself needs no documentation
What Changed Recently?
The settlement is newly open to claims. Modernizing Medicine, Inc. has agreed to resolve Cavallaro-Kearins v. Modernizing Medicine, Inc., Case No. 9:25-cv-81443-EA, in the United States District Court for the Southern District of Florida, and the Court has authorized notice to the class. Simpluris is administering the settlement, and the claim portal, the long-form notice, the claim form and the settlement agreement are all live on the official settlement website.ModMed denies that it did anything wrong, and the Court has not decided who is right. The Notice states that the parties agreed to settle to avoid the costs, risks, disruptions and uncertainties of continuing the litigation. No finding of liability has been made against the company.
What the Case Is About
Modernizing Medicine is a medical software company headquartered in Boca Raton, Florida, that builds electronic health record platforms used by medical practices. Because practices run their records through that software, ModMed holds patient data for people who have probably never heard of it — which is what makes a breach at a vendor like this reach so many patients at once.According to the Notice, the case concerns a targeted cyberattack discovered in July 2025 on two ModMed computer servers. Those servers were not general production systems: the Notice describes them as servers used to facilitate the conversion of limited data from retiring electronic health record platforms to ModMed's current platform. Certain files on them that contained Private Information were accessed.
The Notice says those files may have contained full names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, health insurance information, and medical information — including medical record numbers, patient account numbers, dates of service, provider and practice names, billing and diagnostic codes, prescription and medication information, and diagnosis and treatment information. That combination is broader than a typical breach. Social Security numbers support ordinary identity theft, while diagnosis codes, prescription histories and medical record numbers open the door to medical identity fraud, which routine credit monitoring is not built to catch.
The underlying complaint, filed November 19, 2025, alleges that ModMed failed to maintain reasonable security safeguards and did not comply with HIPAA and FTC data-security expectations, and it pleads negligence, breach of implied contract, invasion of privacy, unjust enrichment and breach of fiduciary duty. It alleges the intrusion began July 9, 2025, that ModMed became aware of it on July 21, 2025, and that notification letters went out on October 17, 2025. It also cites a Massachusetts data-breach report showing 737 residents of that state alone were affected, and says the nationwide figure was not publicly known when it was filed. Every one of those points is an allegation that ModMed denies and that no court has ruled on.
Who Qualifies?
The Court defined the Settlement Class as all living individuals residing in the United States who were sent a notice of the Data Incident indicating their Private Information was impacted in it.That definition is unusually clean to apply. There is no purchase to prove, no date range to check and no judgment call about whether your data was involved — the question is simply whether ModMed sent you a notice about this incident. If a notice reached you, you are in the class. If you are not sure, the Contact page on the official settlement website is the route to ask the Settlement Administrator.
Four groups are excluded: directors, officers and agents of ModMed or its subsidiaries and affiliated companies; governmental entities; the judge assigned to the case, that judge's immediate family, and court staff; and anyone who timely and validly opts out of the settlement.
How Much Can You Get?
ModMed will establish a Settlement Fund of $2,999,750.00. That fund first pays court-approved attorneys' fees and costs and the costs of administering the settlement; what remains — the Net Settlement Fund — pays the benefits below.- Medical data monitoring — two years of CyEx Medical Shield Complete. Available to every Settlement Class Member, with $1 million of medical identity theft insurance and no deductible, real-time monitoring with one credit bureau, dark web scanning with immediate notification of potential unauthorized use, security freeze assistance, and identity theft victim assistance with access to a fraud resolution agent.
- Cash Payment A — documented losses, up to $5,000. For actual, documented out-of-pocket losses related to the incident that occurred between July 9, 2025 and November 2, 2026: money lost to identity theft or fraud, fees for credit reports, credit monitoring or freezing and unfreezing credit, the cost of replacing IDs, and postage to contact banks by mail.
- Cash Payment B — alternate cash, estimated at $75. A one-time payment with no proof and no explanation required.
The structure here is simpler than on most breach settlements, and the simplification matters. The two cash options are alternatives: the Notice says Settlement Class Members may elect Cash Payment A or Cash Payment B, so there is no stacking to work out and no lost-time tier to attest to. The monitoring is not part of that trade — it is offered to every class member in addition to whichever cash option is chosen.
One provision is worth knowing before you decide, because it removes most of the downside of trying for the larger tier. The Notice states that if you do not submit reasonable documentation supporting a loss, or if the Settlement Administrator rejects your claim for any reason and you fail to cure it, the claim will be rejected and treated as if you had elected Cash Payment B. A documented claim that falls apart therefore lands on the roughly $75 payment rather than on nothing.
The $75 is an estimate, not a fixed amount. The Notice says that depending on the total number and total value of Cash Payment claims, your payment may be slightly higher or lower than the amount you claim, and points to Paragraph 71 of the Settlement Agreement for the full mechanics — the standard way a fixed fund adjusts to an unpredictable claim rate, which our explainer on pro rata distribution walks through. Note the direction runs both ways here: the figure can move up as well as down. The Notice does not state how many people were sent notice, so what any individual claim is finally worth cannot be calculated from the public documents.
Expenses already reimbursed from another source cannot be claimed. The Notice is specific that this includes compensation provided in connection with the credit monitoring and identity theft protection product ModMed offered as part of its original notification letter.
What Proof Is Required?
Filing online requires the LoginID and PIN printed on the notice sent to you. The claim page is a login screen, so those credentials are not optional there — which is why this page treats the settlement as Proof Required: Yes even though the $75 option asks for no documentation of any kind.Past that credential, the burden depends entirely on which cash option you pick:
- Cash Payment B, the estimated $75: no proof and no explanation.
- Cash Payment A, up to $5,000: reasonable documentation supporting the losses.
The Notice defines reasonable documentation narrowly: documentation contemporaneously generated or prepared by a third party that supports a claim for expenses paid. It gives telephone records, correspondence including emails, and receipts as non-exhaustive examples. A personal certification, declaration or affidavit does not qualify as reasonable documentation on its own — it may be submitted to give clarification, context or support to other documentation, but it cannot carry a claim by itself.
If you no longer have your notice, a printable Claim Form can be downloaded from the official settlement website and returned by mail along with any supporting documentation, and the Contact page on that website is the route for asking the administrator to help identify your claim.
What Are the Deadlines?
Three dates, and the first two land two weeks before the third:- October 19, 2026 — exclude yourself. An Opt-Out Request must be submitted, postmarked or emailed by this date, carrying the case name and number, your full name, mailing address, telephone number and email address if you have one, your personal signature, and the words "Opt-Out Request" or a clear equivalent. You may only exclude yourself, not anyone else.
- October 19, 2026 — object. A complete objection must be filed with the Clerk of Court by this date, with copies sent to the Settlement Administrator, Class Counsel and Defendant's Counsel.
- November 2, 2026 — submit a claim. Online by this date, or the completed and signed Claim Form with any supporting documentation postmarked no later than this date.
The two-week gap is the practical trap. Anyone weighing whether to keep the right to sue ModMed individually has to decide by October 19, because the settlement offers no way to opt out after that even though claims stay open another fortnight. Our glossary entry on opting out of a class action covers what that choice trades away.
The objection requirements are demanding, and the Notice states that an objection must meet every one of them to be valid. Beyond your grounds and any legal support for them, an objector must disclose how many times they have objected to a class action settlement in the past five years — with the caption of each case and copies of any trial and appellate orders ruling on those objections — the same disclosure for their counsel and counsel's firm, the identity of any lawyers representing them and whether those lawyers will appear at the hearing, a list of any witnesses who will testify in support, whether the objector intends to appear or testify personally, and, unusually, a statement confirming whether any form of artificial intelligence was used in preparing the objection. The objector's own signature is required; an attorney's signature alone is not sufficient.
Objecting does not cost you the money. The Notice confirms that a class member who objects may also submit a claim for settlement benefits. Opting out does: an opt-out cannot object, and the Notice adds that anyone who both opts out and objects is deemed to have opted out, with the objection overruled.
How Do You File?
Claims go through the official settlement website, Modernizing Medicine Data Settlement.com, run by Simpluris. The Notice calls filing online the fastest route: log in with the LoginID and PIN from your notice, choose Cash Payment A or Cash Payment B, upload documentation if you are claiming documented losses, and elect the medical data monitoring.If you prefer paper, the same site hosts a downloadable Claim Form that can be completed and mailed to the Settlement Administrator with any supporting documentation, postmarked by November 2, 2026. Whichever route you take, keep a copy of what you submit. Filing is free, and class members are not charged for Class Counsel's services.
Who Pays the Fees
The fees come out of the fund here, which means they come out of what claimants share. The Court appointed Jeff Ostrow of Kopelowitz Ostrow P.A., Mariya Weekes of Milberg PLLC, and Raina Borrelli of Strauss Borrelli PLLC as Class Counsel. They will ask the Court to approve up to one-third of the Settlement Fund as attorneys' fees, plus reimbursement of litigation costs.One-third of $2,999,750.00 is about $999,917. Adding litigation costs and the cost of administering the settlement — neither of which the Notice quantifies — the Net Settlement Fund available for class benefits is somewhere below $2 million. That is our arithmetic on the figures in the Notice, not a projection from the administrator, and the Court has not yet ruled on the fee request; it may award less than what Class Counsel asks for. The Notice describes only fees and costs and does not describe a service award for the class representative.
What You Give Up
Staying in the Settlement Class means you cannot be part of any other lawsuit against ModMed or the Released Parties over the Released Claims. Section XIII of the Settlement Agreement sets out exactly what is given up, and the agreement is posted on the official settlement website.Doing nothing does not avoid that release. A class member who never files still gives up those claims and receives no cash and no monitoring — the only way to keep the right to sue ModMed on your own is to opt out by October 19, 2026.
What Happens Next?
At the November 17, 2026 hearing the Court will decide whether to approve the settlement, will rule on Class Counsel's request for attorneys' fees and costs, and will consider any objections. Class members may ask permission to speak at the hearing at their own cost, but nobody is required to attend — the Notice says Class Counsel will answer any questions the Court has, and that a properly filed objection will be considered whether or not the objector shows up. The Notice cautions that the date and time may change without further notice, so anyone planning to attend should confirm on the settlement website first.If approval is granted, settlement payments and the activation codes for the medical data monitoring go out only after any appeals are resolved. A hearing being held is not the same as approval being granted, and approval being granted is not the same as payments being released. The Notice is candid that it is unknown whether appeals will be filed or how long they would take, so no payment date exists yet.
Class Action Summary
| Case Title | Cavallaro-Kearins v. Modernizing Medicine, Inc. |
|---|---|
| Case Number | 9:25-cv-81443-EA |
| Court | U.S. District Court, Southern District of Florida |
| Defendant | Modernizing Medicine, Inc. (ModMed) |
| Incident | July 2025 targeted cyberattack on two EHR data-conversion servers |
| Data Involved | Names, addresses, dates of birth, phone numbers, email addresses, Social Security numbers, health insurance information, medical records and treatment information |
| Settlement Fund | $2,999,750.00 |
| Cash Benefit | An estimated $75 with no documentation, or up to $5,000 documented — not both |
| Monitoring | 2 years CyEx Medical Shield Complete · $1M medical identity theft insurance |
| Claim Deadline | November 2, 2026 |
| Opt-Out / Object By | October 19, 2026 |
| Final Approval Hearing | November 17, 2026 at 2:30 PM Eastern (West Palm Beach) |
| Administrator | Simpluris |
| Official Website | Modernizing Medicine Data Settlement.com |
Sources and Verification
• Official settlement website — Modernizing Medicine Data Settlement.com• Notice of Proposed Class Action Settlement (PDF)
• The settlement website's FAQ, Important Dates and claim pages, and the downloadable Claim Form
• Cavallaro-Kearins v. Modernizing Medicine, Inc., No. 9:25-cv-81443-EA (S.D. Fla.) — Class Action Complaint filed November 19, 2025, and the Settlement Agreement posted on the official website
• Vermont Attorney General — Modernizing Medicine notice of data breach to consumers, October 17, 2025 (PDF, as cited in the complaint)
• HHS — HIPAA Breach Notification Rule
Questions
Can I claim both the $75 and the documented losses?
No. The Notice presents them as alternatives — Settlement Class Members may elect Cash Payment A, documented losses up to $5,000, or Cash Payment B, the one-time alternate cash payment estimated at $75. The medical data monitoring is different: it is available to every Settlement Class Member in addition to whichever cash option is chosen, so nobody has to trade the monitoring for cash.
What happens if my documented-loss claim gets rejected?
It converts rather than disappearing. The Notice states that if you do not submit reasonable documentation supporting a loss, or if the Settlement Administrator rejects your claim for any reason and you fail to cure it, the claim will be rejected and treated as if you had elected Cash Payment B, the alternate cash payment. That makes attempting the documented tier a low-risk choice — a failed $5,000 claim falls back to the roughly $75 payment rather than to nothing.
Why is the $75 described as an estimate?
Because the Settlement Fund is fixed and the number of claims is not. The Notice says that depending on the total number and total value of Cash Payment claims, your payment may be slightly higher or lower than the amount you claim, and points to Paragraph 71 of the Settlement Agreement for the full mechanics. The Notice does not state how many people were sent notice, so the final per-person figure cannot be calculated from the public documents.
What counts as reasonable documentation for the $5,000 tier?
Documentation contemporaneously generated or prepared by a third party that supports a claim for expenses paid — the Notice gives telephone records, correspondence including emails, and receipts as non-exhaustive examples. Your own certification, declaration or affidavit does not count as reasonable documentation on its own, though it may be submitted to give clarification, context or support to other documentation. Expenses already reimbursed from another source, including anything covered by the credit monitoring and identity theft protection ModMed offered with its notification letter, cannot be claimed.
Why does the claim deadline fall after the opt-out deadline?
That is the usual pattern, and it matters here because the gap is two weeks. October 19, 2026 is the last day to exclude yourself or to object; November 2, 2026 is the last day to file a claim. Anyone still deciding whether to keep the right to sue ModMed individually has to make that call two weeks before the claim window closes, because opting out later is not possible.
What if I no longer have the LoginID and PIN from my notice?
The online claim form opens on a login screen requiring the LoginID and PIN printed on the notice that was sent to you, so those credentials are not optional there. A printable Claim Form can be downloaded from the official settlement website and returned by mail with any supporting documentation, and the Contact page on that website is the route for asking the Settlement Administrator to help you identify your claim.
Official Settlement Notice
For more class actions keep scrolling below.
Settlement Amount
$2,999,750.00
fees, costs and administration come out of the fund first
Case Title
Cavallaro-Kearins v. Modernizing Medicine, Inc.
Case Number
9:25-cv-81443-EA
Court
U.S. District Court, Southern District of Florida
Final Approval Hearing
November 17, 2026 at 2:30 PM ET
West Palm Beach · date and time may change without further notice
Administrator
Simpluris
Official Website
Modernizing Medicine Data Settlement
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
