The lawsuit follows a data breach that impacted over a million individuals in 2024.

 

What happened

Palomar Health Medical Group (also known as Arch Health Partners) recently agreed to settle the lawsuit Castro et al. v Arch Health, Inc. d/b/a Palomar Health Medical Group, which is pending in the Superior Court for the State of California, County of San Diego.

Under the settlement, Palomar has agreed to establish a $3.1 million settlement fund, which will go towards legal and administrative costs, as well as funds for class members and service awards for class representatives.

 

Going deeper

According to the lawsuit, Palomar allegedly violated multiple privacy laws, like the California Consumer Privacy Act and the California Confidentiality of Medical Information act, and acted negligently. Despite the claims, under the settlement, Palomar is able to deny all wrongdoing.

Anyone who wishes to object or opt out of the settlement must do so by October 7th, 2026. The final fairness hearing, which is where the settlement will be confirmed, is scheduled for November 6th, 2026.

 

The backstory

The lawsuit stems from a breach that was identified by Palomar on May 5th, 2024, according to their data breach notice, which remains available online. The organization’s investigation determined that some files within their network had been accessed between April 23rd, 2024, and May 5th, 2024. The investigation was completed on September 4th, 2025, and determined that the following information may have been accessed: names, addresses, dates of birth, Social Security numbers, driver’s license number, state identification numbers, passport information, financial account information, health and medical information, email addresses, and associated passwords.

 

The big picture

Palomar Health joins a trove of other organizations that have faced class action lawsuits following a data breach. Just in the month of September, 2026, Paubox has already covered multiple cases. The settlements range vastly, with Total Vision’s settlement only at $475,000, while another major hacking incident against DaVita health resulted in a settlement of $15 million. The variation can largely be attributed to the number of victims and size of the organizations, but other factors can also play a role, like how long the breach lasted, how quickly victims were notified, and if the victims can prove that the organizations they are suing were negligent. As these lawsuits continue to be frequent, organizations have to consider how they would stack up against common lawsuit claims, like breach of implied contract and patient privacy laws. While data breaches can often be based on opportunity or somewhat random, organizations can do a lot to prepare for the breaches themselves and prepare their legal teams for proper response, so that lawsuits are less detrimental to their operations.

 

FAQs

Why are class action lawsuits so popular?

Class action suits have grown greatly in popularity over the years because there is a precedent that healthcare organizations are responsible for maintaining data security and should be held monetarily responsible if they don’t. These suits come up frequently because they are fairly easy for plaintiffs to win, so long as there is sufficient evidence.

 

Do settlements ever not make it through the final fairness hearing?

It’s possible for there to be a delay or renegotiation, but it’s very unlikely. The final fairness hearing is a review by the judge to make sure that the deal is considerate and fair for all members, but the majority of negotiations would have already happened by this point.

 

Does it matter how long a data breach lasts?

A longer data breach timeframe theoretically means that the bad actor has more time to access and steal files. In some cases, it could also allow malicious software to spread. However, more or less time in a system doesn’t determine the amount of damage; some data breaches can still be significant and completed in a short time frame. AI has helped automate many hacker’s jobs, making the breach more destructive in smaller time spans.