Thousands of area residents have received notice that they could be entitled to compensation as a part of a class action lawsuit lodged on behalf of patients who may have had their personal data compromised during last year’s cyberattack on HealthAlliance hospitals in Kingston and Margaretville. The settlement entitles eligible parties who meet a Nov. 19 deadline to file a claim to $100.

According to the settlement in the case J.M. et al. vs. HealthAlliance, the data breach took place between Aug. 18 and Oct. 12 of 2023 and may have impacted as many as 260,000 current and former patients. The data breach was followed immediately by a days-long attack on HealthAlliance’s computer network, begun on Oct. 15. That attack forced the hospital to divert patients and eventually evacuate all inpatients from the facility before service was restored on Oct. 21. It is unclear how or if the two incidents are related. Officials at HealthAlliance Hospital and parent company the Valhalla-based WMCHealth Network did not admit wrongdoing or negligence in the settlement.

“[HealthAlliance] denies the claims alleged in the lawsuit or that it did anything wrong but has agreed to this settlement in the interest of its patients and to focus on its healthcare operations,” the notice of settlement sent eligible parties this week reads.

The settlement creates a $1.29 million compensation fund that will pay all claims as well as legal expenses and other administrative costs. The settlement is open to anyone who received a notice that their data may have been compromised. The settlement is overseen by state Supreme Court in Westchester County. Four law firms appointed by the court will serve as class counsel to represent all class members who do not wish to hire their own attorney. All claims will be processed through the website www.HAsettlement.com. All class members will receive three years of free monitoring. Class members are also entitled to a flat fee of $100 or can claim loss of time up to four hours for up to $25 an hour. Additionally, class members who can demonstrate that they suffered actual harm related to the cyberattack may receive up to $7,500 in additional compensation.

Class members who opt to sue HealthAlliance independently must file to remove themselves from the settlement by Nov. 4. Nov. 4 is also the deadline for anyone who wishes to send a written statement to the court challenging approval of the settlement. Class members may also participate in a Dec. 4 virtual “Final Approval Hearing” for the deal.

Representatives of the law firms chosen to represent class members either were not available or declined to discuss the settlement. In a statement issued Tuesday, WMCHealth said: “HealthAlliance takes patient privacy and the protection of patient information very seriously. Cybersecurity is a global concern impacting even the most well-protected organizations. Healthcare organizations are often the target of such criminal activities, and we are committed to continually enhancing our security measures to safeguard information.”