Published
August 25, 2026
This settlement resolves claims over a September 2024 targeted cyberattack on the computer systems of Summit Medical Group, PLLC, in which files containing medical record numbers, treatment and prescription information, health insurance details and Social Security numbers were potentially accessed. If Summit Medical mailed you a notice, you can claim up to $2,500 in documented losses and up to $45 for time you spent dealing with it — these two stack — and enroll in two years of medical data monitoring on top.
Current Status
Claims are open. The deadline to file is November 4, 2026, online or postmarked. The deadlines to opt out or to object come two weeks earlier, on October 20, 2026. The Court has scheduled a Final Approval Hearing for November 19, 2026 at 10:00 a.m. in Knoxville, and the settlement has not been approved yet. No payment date has been announced: the Notice says payments are distributed only if the Court grants final approval and after any appeals are resolved, and that it is not known whether appeals will be filed. If a notice reached you, it carries the LoginID and PIN you need to file online.
Status
Claims Open
final approval hearing November 19, 2026 in Knoxville, Tennessee
Claim Deadline
November 4, 2026
online or postmarked · opting out and objecting close earlier, on October 20
Estimated Payout
Up to $2,545
$2,500 documented losses plus $45 lost time — these stack · two years of medical data monitoring on top
Proof Required
Yes
LoginID and PIN from your notice to file online · receipts for the $2,500 tier; the lost-time claim is attested
What Changed Recently?
The settlement is newly open to claims. Summit Medical Group, PLLC has agreed to resolve Harris, et al. v. Summit Medical Group, PLLC, Case No. 2-119-25, in the Circuit Court for Knox County, Tennessee, and the Court has authorized notice to the class. Simpluris is administering it, and the claim portal, the long-form notice, the claim form and the settlement agreement are live on the official settlement website.Summit Medical denies that it did anything wrong, and the Court did not decide whether the plaintiffs or the defendant are right. The Notice states that both sides agreed to settle to avoid the costs and risks of a trial and to let class members receive benefits. No finding of liability has been made.
What the Case Is About
According to the Notice, the case concerns a targeted cyberattack on Summit Medical's computer systems in September 2024, during which files containing Private Information were potentially accessed.The Notice says those files may have contained names, contact information, demographic information, medical record numbers, provider names, dates of services, facilities of service, treatment information, prescription information, health insurance information and Social Security numbers. That spread is heavily weighted toward clinical data. Social Security numbers support ordinary identity theft, but medical record numbers, treatment histories, prescription records and insurance details are the raw material for medical identity fraud — someone obtaining care or prescriptions in your name — which routine credit monitoring is not designed to detect. The monitoring offered here is built around exactly that risk.
The Notice also mentions that Summit Medical's records indicate class members are entitled to benefits, and that some people may have received an earlier notice directly from Summit Medical before this court-authorized one. If you remember a letter about this from 2024 or 2025 and then a second notice arrived, that is the sequence being described, not a duplicate.
Who Qualifies?
The Court defined the Settlement Class as all living individuals in the United States whose Private Information was potentially compromised in the Data Incident, including everyone who was mailed notice of it by Summit Medical.Read the geography carefully, because it is the point most likely to be misread. The case is in a Tennessee state court and Summit Medical is a Tennessee practice, but the class is nationwide — the definition is all living individuals in the United States, with no residency requirement attached. A former patient who has since moved to another state is still a class member if a notice was mailed to them.
Three groups are excluded: directors and officers of Summit Medical or its subsidiaries and affiliated companies; governmental entities; and the judge or judges assigned to the case, along with the judge's immediate family and court staff.
How Much Can You Get?
Every class member can claim all three benefits. That is worth stating first, because plenty of breach settlements force a choice between a flat payment and a documented one — this settlement does not.- Medical data monitoring — two years of CyEx Medical Shield Complete. Available to every Settlement Class Member, with $1 million of medical identity theft insurance, and monitoring aimed specifically at healthcare insurance ID exposure, Medical Record Number exposure, and unauthorized Health Savings Account spending, plus access to a fraud resolution agent.
- Cash Payment A — documented losses, up to $2,500. For actual, documented out-of-pocket losses caused by the incident and incurred between September 2024 and November 4, 2026: money lost to identity theft or fraud, fees for credit reports, credit monitoring or freezing and unfreezing credit, the cost of replacing IDs, and postage to contact banks by mail.
- Cash Payment B — lost time, up to $45. Up to three hours at $15.00 per hour for time spent responding to the incident, such as changing passwords, investigating suspicious account activity or researching the incident.
The two cash options are cumulative, not alternatives. The Notice says class members may claim the monitoring and two Cash Payment options, and introduces the lost-time payment with the word additionally. Someone with full documentation can therefore reach $2,545 in cash and still enroll in the monitoring.
The absence of a flat alternate cash payment is the other half of that structure, and it cuts the other way. There is no $50 or $75 tier here that pays on your word alone, so a class member holding no receipts is looking at the lost-time claim and the monitoring — realistically up to $45 in cash. Anyone who did spend money because of this breach and still has the paperwork is in a very different position from someone who did not.
One cap applies to the whole class rather than to individuals. The Notice says any cash payment may be decreased on a pro rata basis if more than $500,000.00 is claimed by eligible class members. Below that aggregate figure the Notice does not describe payments reducing; above it, everyone's cash is scaled down proportionally, the mechanism our explainer on pro rata distribution walks through. The Notice does not state how many people were mailed notice, so whether that threshold is likely to be reached cannot be worked out from the public documents.
Expenses already reimbursed by a third party cannot be claimed.
What Proof Is Required?
Filing online requires the LoginID and PIN printed on the notice mailed to you. The claim page is a login screen, so those credentials are not optional there — which is why this page treats the settlement as Proof Required: Yes, before you even reach the question of receipts.Past that credential, the burden splits sharply between the two cash options:
- Cash Payment A, up to $2,500: proof such as receipts showing how much you spent or lost. The Claim Form asks you to itemize each expense with a description of the supporting documentation and an amount, and to total them.
- Cash Payment B, up to $45: no receipts. You select one, two or three hours, briefly describe how you spent the time, and attest that it was spent as a result of the Data Incident.
The Notice is explicit about one limit that catches claimants out: your personal certifications, declarations or affidavits do not constitute reasonable documentation for the documented-losses tier. A written statement can be submitted to give clarification, context or support to other documentation showing your expenses were because of this incident — but it cannot carry that claim on its own. The whole Claim Form is signed under penalty of perjury, and the Notice says claims are subject to verification and that the administrator may ask for supplemental information.
If you no longer have your notice, the settlement website explains that the Settlement Administrator can supply your LoginID and PIN if you provide your full name and mailing address. A printable Claim Form can also be downloaded from the official website and returned by mail with any supporting documentation.
What Are the Deadlines?
Three dates, with the two that decide your legal rights falling first:- October 20, 2026 — opt out. An Opt-Out Request must be postmarked by this date, carrying the case name and number, your full name, mailing address, telephone number and email address, your personal signature, and the words "Opt-Out Request" or a clear equivalent. You may only exclude yourself, not anyone else.
- October 20, 2026 — object. A complete objection must be filed with the Clerk of Court by this date, with copies mailed to the Settlement Administrator, Class Counsel and Defendant's Counsel.
- November 4, 2026 — submit a claim. Online by this date, or the completed and signed Claim Form with any supporting documentation postmarked no later than this date.
The two-week gap is the practical trap. Anyone weighing whether to keep the right to sue Summit Medical individually has to decide by October 20, because there is no way to opt out afterward even though claims stay open another fortnight. Our glossary entry on opting out of a class action covers what that choice trades away.
The objection requirements are demanding, and the Notice says an objection must meet every one of them to be considered. Beyond your grounds and any legal support for them, an objector must disclose how many times they have objected to a class action settlement in the past five years — with the caption of each case and copies of any trial and appellate orders ruling on those objections — the same disclosure for their counsel and counsel's firm, the identity of all counsel representing them and whether those counsel will appear at the hearing, a list of anyone who will testify in support, and whether the objector or their counsel intends to appear or testify. Your own signature is required; if you have hired a lawyer, their signature alone is not sufficient.
Objecting does not cost you the money. The Notice confirms that a class member who objects may also file a claim for settlement benefits. Opting out does: an opt-out cannot object, and receives no cash and no monitoring.
How Do You File?
Claims go through the official settlement website, Summit Medical Data Settlement.com, run by Simpluris. The Notice calls filing online the fastest route: log in with the LoginID and PIN from your notice, tick the monitoring, itemize any documented losses with supporting documentation, select your lost-time hours, and sign.The Claim Form asks you to pick how you want to be paid, and the options are broader than most: PayPal, Venmo, Zelle, an eMasterCard, or a physical check mailed to the address you provide. Choosing an electronic method is worth a moment's thought, since a mailed check is the slowest of the five and the easiest to lose in a move.
If you prefer paper, the same site hosts a downloadable Claim Form to complete and mail to the Settlement Administrator with any supporting documentation, postmarked by November 4, 2026. Keep a copy of whatever you submit. Filing is free, and class members are not charged for Class Counsel's services.
Who Pays the Fees
Summit Medical does, separately — which works in class members' favor. The Court appointed J. Gerard Stranch, IV of Stranch, Jennings & Garvey, PLLC; Jeff Ostrow of Kopelowitz Ostrow, P.A.; Lisa A. White of Mason LLP; and Tyler J. Bean of Siri & Glimstad LLP as Class Counsel. They will ask the Court to approve up to $575,000.00 in attorneys' fees and costs of litigation, and service award payments of $2,500.00 for each of the class representatives. The Notice states that Summit Medical pays both.Because those payments come from the defendant rather than out of the money available to claimants, they do not reduce anyone's recovery — the $500,000 pro rata threshold sits apart from them. On a common-fund settlement the opposite is true, and fees typically come off the top before anyone is paid. The Court will rule on both requests at the final approval hearing and may award less than what is asked.
What You Give Up
Staying in the Settlement Class means you cannot be part of any other lawsuit against Summit Medical about the issues this settlement covers. Section XI of the Settlement Agreement sets out the claims released, and the agreement is posted on the official settlement website.Doing nothing does not avoid that release. A class member who never files still gives up those claims and receives no cash and no monitoring — the only way to keep the right to sue Summit Medical on your own is to opt out by October 20, 2026.
What Happens Next?
At the November 19, 2026 hearing the Court will decide whether to approve the settlement, will rule on Class Counsel's request for fees and costs and on the service awards, and will consider any timely objections. Nobody is required to attend — the Notice says Class Counsel will answer the Court's questions, and that a properly filed objection will be considered whether or not the objector appears.One detail is worth checking before you plan around it: the official documents disagree on the time zone. The long-form Notice gives the hearing as 10:00 a.m. Eastern Time, while the FAQ page on the settlement website gives the same date and time as Central Time. The courthouse is in Knoxville, Tennessee, which observes Eastern Time. The Notice separately warns that the date and time may change without further notice, so the settlement website is the place to confirm.
If approval is granted, payments follow only after any appeals are resolved. A hearing being held is not the same as approval being granted, and approval being granted is not the same as payments being released. The Notice is candid that it is unknown whether appeals will be filed or how long they would take, so no payment date exists yet.
Class Action Summary
| Case Title | Harris, et al. v. Summit Medical Group, PLLC |
|---|---|
| Case Number | 2-119-25 |
| Court | Circuit Court for Knox County, Tennessee |
| Defendant | Summit Medical Group, PLLC |
| Incident | September 2024 targeted cyberattack on Summit Medical's computer systems |
| Data Involved | Names, contact and demographic information, medical record numbers, provider names, dates and facilities of service, treatment and prescription information, health insurance information and Social Security numbers |
| Class Scope | Nationwide — all living individuals in the United States mailed notice of the incident |
| Cash Benefit | Up to $2,500 documented plus up to $45 lost time — cumulative, not a choice |
| Monitoring | 2 years CyEx Medical Shield Complete · $1M medical identity theft insurance |
| Pro Rata Trigger | Cash reduced only if more than $500,000 is claimed class-wide |
| Claim Deadline | November 4, 2026 |
| Opt-Out / Object By | October 20, 2026 |
| Final Approval Hearing | November 19, 2026 at 10:00 AM (Knoxville, TN) |
| Administrator | Simpluris |
| Official Website | Summit Medical Data Settlement.com |
Sources and Verification
• Official settlement website — Summit Medical Data Settlement.com• Notice of Proposed Class Action Settlement (PDF)
• Data Incident Settlement Claim Form (Case ID 9645), and the settlement website's FAQ, Important Dates and claim pages
• Harris, et al. v. Summit Medical Group, PLLC, No. 2-119-25 (Cir. Ct. Knox Cnty., Tenn.) — Settlement Agreement posted on the official website
• HHS — HIPAA Breach Notification Rule
Questions
Can I claim the documented losses and the lost time together?
Yes. The Notice says all Settlement Class Members may claim Medical Data Monitoring and two Cash Payment options, and introduces the lost-time payment with the word additionally. The two cash options are cumulative rather than a choice, so the ceiling is $2,545 — up to $2,500 in documented out-of-pocket losses plus up to $45 for three hours of lost time — with the monitoring on top of either.
What can I get if I have no receipts?
The lost-time payment and the monitoring. There is no flat alternate cash payment in this settlement — no $50 or $75 option that pays on your word alone — so the documented-losses tier is the only route to substantial cash. Without documentation, the realistic claim is up to $45 for three hours at $15 per hour, which requires a brief description of how the time was spent and an attestation rather than receipts, plus two years of CyEx Medical Shield Complete.
Could my payment be reduced?
Yes, but only above a stated threshold. The Notice says any cash payment may be decreased on a pro rata basis if more than $500,000.00 is claimed by eligible Settlement Class Members. Below that figure the amounts are not described as reducing. Attorneys' fees and costs of up to $575,000.00 and the service awards are paid separately by Summit Medical rather than out of that $500,000, so they do not eat into what claimants share.
Is this settlement only for Tennessee patients?
No. Although the case is pending in the Circuit Court for Knox County, Tennessee, the Court defined the Settlement Class as all living individuals in the United States whose Private Information was potentially compromised in the Data Incident, including everyone mailed notice of it by Summit Medical. There is no residency requirement, so a former patient who has since moved out of state is still a class member if a notice was mailed to them.
What time is the final approval hearing?
The official documents disagree, so confirm before relying on it. The long-form Notice states the hearing is on November 19, 2026 at 10:00 a.m. Eastern Time, while the FAQ page on the settlement website gives the same date and time as Central Time. The courthouse is in Knoxville, Tennessee, which observes Eastern Time. The Notice also warns that the date and time may change without further notice, so anyone planning to attend should check the settlement website first.
What if I no longer have the LoginID and PIN from my notice?
The online claim form opens on a login screen requiring the LoginID and PIN printed on the notice mailed to you. The settlement website explains that anyone unable to locate those credentials can request them from the Settlement Administrator by supplying their full name and mailing address through the site's contact route. A printable Claim Form can also be downloaded from the official website and returned by mail with any supporting documentation.
Official Settlement Notice
For more class actions keep scrolling below.
Settlement Amount
No common fund
cash reduced pro rata only above $500,000 claimed class-wide · fees and service awards paid separately by Summit Medical
Case Title
Harris, et al. v. Summit Medical Group, PLLC
Case Number
2-119-25
Court
Circuit Court for Knox County, Tennessee
Final Approval Hearing
November 19, 2026 at 10:00 AM
Knoxville, Tennessee · the Notice says Eastern and the website FAQ says Central · date and time may change
Administrator
Simpluris
Official Website
Summit Medical Data Settlement
Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
