On June 6, the Circuit Court for Baltimore City granted preliminary approval of a proposed settlement agreement that requires LifeBridge Health Inc., the largest provider of health care services in the Baltimore area, to pay a $9.5 million settlement.^[1]

The settlement stems from a class-action lawsuit arising out of two security incidents that LifeBridge Health publicly announced around May 2018 and June 2020, respectively.^[2] In the first incident, some of LifeBridge Health’s computer network systems were the target of a cyberattack and the information of more than 538,127 patients was affected, including names, dates of birth, addresses, diagnoses, prescription information, clinical and treatment information, insurance details and Social Security numbers. In the second incident, an unauthorized user obtained access to copies of documents held by M&T Bank in its lockbox account for LifeBridge Health’s affiliate, Sinai Hospital of Baltimore, Inc. The plaintiffs alleged negligence, negligent misrepresentation, violation of the Maryland Personal Information Protection Act and violation of the Maryland Consumer Protection Act.