This settlement covers the May 2024 data breach at Okanogan Behavioral Healthcare, the behavioral health provider in Omak, Washington, which exposed the records of 26,429 people — including diagnosis and treatment information. Unlike most breach settlements, the $50 cash payment here stacks with the documented-loss tiers rather than ruling them out, so a class member with receipts can claim up to $5,350 in total.
Current Status
Claims are open. The deadline to file is September 3, 2026. The deadline to object or to request exclusion was August 4, 2026 and has passed, so the remaining decision for anyone still in the class is whether to file. The Court has set the final approval hearing for September 3, 2026 at 9:00 a.m. — the same day the claim window closes — and the settlement has not been approved yet. No payment date has been announced.What Changed Recently?
The settlement is open to claims and closing in early September. Okanogan Behavioral Healthcare has agreed to resolve John Doe v. Okanogan Behavioral Healthcare, Case No. 24-2-00502-24, in the Superior Court of the State of Washington for the County of Okanogan. Notice has gone out, the exclusion and objection window has already closed, and the claim portal and settlement documents are live on the official settlement website.Okanogan Behavioral Healthcare denies wrongdoing and liability and disagrees with the claims and contentions in the lawsuit. No court has found that it did anything wrong. Under the settlement the provider has agreed to cover attorneys' fees and expenses, the costs of notice and administration, and a service award for the class representative.
What the Case Is About
Okanogan Behavioral Healthcare is a behavioral health provider based in Omak, Washington, serving Okanogan County in the north-central part of the state.According to the settlement materials, the provider discovered a data incident in May 2024 involving unauthorized access to systems holding sensitive personal information about its clients. The unauthorized access is described as having occurred from May 13, 2024 until May 15, 2024, and 26,429 individuals were affected.
The information involved included names, addresses, dates of birth, Social Security numbers, driver's license and other identification numbers, health insurance information, and medical information including diagnosis and treatment details.
That last category is why this breach sits in a different weight class from a retailer's. Diagnosis and treatment records from a behavioral health provider are among the most sensitive documents a person has, and the exposure of them is a distinct harm from financial identity theft — one that credit monitoring does not address and that no remedy can undo, because unlike a card number a diagnosis cannot be reissued. The lawsuit alleged the provider failed to adequately protect that information; those are allegations, and the Court has made no finding of wrongdoing.
Who Qualifies?
The Settlement Class covers the individuals whose personal information was involved in the May 2024 incident — the 26,429 people the provider identified and notified.Membership turns on whether your information was caught up in the breach, not on where you live now. The provider serves Okanogan County, so in practice most class members are current or former Washington residents, but a former client who has since moved out of state is not excluded for that reason. The notice sent by the settlement administrator is the practical marker of who is in.
How Much Can You Get?
The benefit structure here is worth reading carefully, because it is more generous in shape than most data breach settlements of this size:- Documented ordinary losses — up to $300 per class member. The routine out-of-pocket costs of dealing with a breach: credit reports, freezes and unfreezes, postage, phone charges, mileage, monitoring you paid for yourself.
- Documented extraordinary losses — up to $5,000 per class member, for actual identity theft or fraud traced to the incident.
- Two years of CyEx Medical Shield Complete credit monitoring, or instead a $50 Alternative Cash Payment.
The part most people get wrong on settlements like this one is the election. On the great majority of data breach settlements, the flat cash payment is an either-or against the documented tier: take the cash and you give up the receipts route. Here it is not. The settlement materials state that the $50 Alternative Cash Payment may be claimed in addition to reimbursement for ordinary and extraordinary losses.
What you actually choose between is the $50 and the two years of monitoring — the cash is offered in lieu of the monitoring, not in lieu of the loss tiers. So a class member with documentation can claim $300 in ordinary losses, $5,000 in extraordinary losses, and the $50 on top, for a theoretical maximum of $5,350. A class member with no losses to document is choosing between $50 in cash now and two years of medical identity monitoring — and given that the exposed data here includes diagnosis and treatment information, medical monitoring is a more relevant product than a standard credit product would be.
All of this assumes valid documentation and is subject to the Court granting final approval.
What Proof or Notice ID Is Required?
Both loss tiers require documentation, and it has to tie the loss to this incident. For ordinary losses that means receipts, statements, invoices for a monitoring service you bought yourself, or records of postage and mileage. For extraordinary losses it means evidence of the fraud or identity theft itself — statements showing the fraudulent activity, correspondence with a bank or creditor, a police or agency report where one exists. Anything already reimbursed by a bank, insurer or employer cannot be claimed again.The $50 Alternative Cash Payment and the credit monitoring require no documentation of loss. Filing online, though, is normally gated on the identifier printed on the notice the administrator sent you, and that identifier is itself a form of proof — someone who never received the notice cannot supply it. Find your notice before you start. If you cannot locate it, use the contact route on the official settlement website to reach the administrator, and do it now rather than in the last days before September 3.
What Is the Deadline?
September 3, 2026. The published materials give the date without specifying a cut-off time or a timezone, so treat the date itself as the deadline, and note that the final approval hearing is scheduled for 9:00 a.m. that same morning. Filing several days ahead rather than on the day removes any argument about it.The deadline to request exclusion or to object was August 4, 2026 and has already passed. Anyone who did not opt out is in the class and will be bound by the release if the Court approves the settlement, whether or not they file a claim — which means that for people still reading, filing is the only remaining way to get anything out of it.
How Do You Take Action?
File on the official settlement website, Okanogan Data Settlement, which is the only court-authorized site for this case. Because the $50 stacks with the loss tiers here, do not treat the form as a single either-or choice: claim the documented losses you can support, then make the separate election between the $50 and the two years of monitoring.Upload your supporting records with the form. A documented claim submitted without documentation is the most common reason this kind of claim is reduced to nothing.
What Happens Next?
The final approval hearing is scheduled for September 3, 2026 at 9:00 a.m., where the Court will consider whether to approve the settlement and rule on fees and the service award. Hearing dates can move without further notice being mailed.A hearing taking place is not the same as approval being granted, and approval is not the same as payments being released. No payment date has been announced. We will update this page when the Court rules and again if a distribution date is published.
Sources and Verification
- Official settlement website — Okanogan Data Settlement, including the court-approved Notice, the FAQ and the Claim Form.
- The HIPAA Journal — reporting on the settlement, the benefit tiers and the number of individuals affected.
- Strauss Borrelli PLLC — early investigation notice describing the May 2024 incident and the categories of data involved.
Questions
Can I take the $50 cash payment and still claim documented losses?
Yes, and that makes this settlement unusual. The published settlement materials state that the $50 Alternative Cash Payment may be claimed in addition to reimbursement for Ordinary and Extraordinary Losses. On most data breach settlements the flat cash payment is an either-or against the documented tier; here it is not. The one thing that is a genuine choice is the $50 against two years of credit monitoring — the alternative cash payment is offered in lieu of the monitoring, so you pick one of those two and can claim documented losses either way.
What is the difference between ordinary and extraordinary losses here?
They are two separate documented tiers with two separate ceilings. Ordinary losses are capped at $300 per class member and cover the routine out-of-pocket costs of responding to a breach — credit reports and freezes, postage, phone charges, mileage, monitoring you paid for yourself. Extraordinary losses are capped at $5,000 per class member and cover actual, documented identity theft or fraud traced to the incident. Both require documentation. Added to the $50 alternative cash payment, the theoretical maximum on this settlement is $5,350.
The claim deadline and the final approval hearing are the same day. Does that affect me?
The published settlement information gives September 3, 2026 as both the claim deadline and the date of the final approval hearing, which is at 9:00 a.m. It does not change what you have to do: the claim still has to be in by the deadline, and the safe course is to file well before that morning rather than on the day. It does mean the Court will be weighing final approval at essentially the moment the claim window shuts, so nothing about payment timing will be settled before you file.
Why is this breach considered more sensitive than a typical one?
Because of what a behavioral health provider records. The information involved included names, addresses, dates of birth, Social Security numbers, driver's license and other identification numbers, health insurance information and medical information including diagnosis and treatment details. Diagnosis and treatment information from a behavioral health setting is among the most sensitive category of record a person has, and unlike a card number it cannot be reissued or revoked once it is out. That is a separate harm from financial identity theft and it is not addressed by credit monitoring.
I moved out of Washington. Am I still covered?
Membership turns on whether your information was involved in the incident, not on where you live now. Okanogan Behavioral Healthcare is based in Omak, Washington and serves Okanogan County, so in practice most class members are current or former Washington residents — but a former patient who has since moved is not excluded for that reason. The notice sent by the settlement administrator is the practical marker of membership, and anyone who believes they were affected but received no notice should use the contact route on the official settlement website before the deadline.
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
