In re OnePoint Patient Care, LLC., Data Breach Litigation

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF KENTUCKY LOUISVILLE DIVISION In re OnePoint Patient Care, LLC., Case No. 3:24-cv-649-RGJ Data Breach Litigation Judge Rebecca Grady Jennings CLASS ACTION

MEMORANDUM OPINION & ORDER Plaintiffs1 are individuals who allege that their private information was exposed in a data breach as a result of Defendant OnePoint Patient Care, LLC (“OnePoint”) failing to sufficiently protect their information. Previously, Plaintiffs moved for preliminary approval of a settlement for a proposed class. [DE 30]. The Court ordered Plaintiffs to supplement their motion for preliminary approval. [DE 31]. Plaintiffs filed a supplementary motion for preliminary approval. [DE 39].

OnePoint does not oppose Plaintiffs’ motion or the motion to supplement. For the following reasons, the Court ORDERS Plaintiffs to file further supplemental briefing on the motions.

I. BACKGROUND A. Litigation History OnePoint is a Kentucky-based pharmacy and pharmacy benefits manager specializing in hospice care serving over 40,000 patients nationally across various service platforms. During the regular course of its operations, OnePoint collects, maintains, and stores its patients’ and employees’ Private Information,2 which includes personally identifiable information and protected 1The named individual Plaintiffs and representatives of the putative class are Christopher Russo (“Russo”) and Shannon Cobb (“Cobb”). [DE 29].

2 Unless otherwise defined, all capitalized terms in this Order have the same definitions as set forth in the parties’ Settlement Agreement. [See DE 30-2 ¶ 52 (defining “Private Information” as “information collected by Defendant, directly or indirectly, pertaining to its current and former patients, including, but not limited to, names, addresses, facility location, and medical information”)]. health information. [DE 29 ¶¶ 23-24]. On or about August 8, 2024, OnePoint noticed suspicious activity within its computer systems and network. [Id. ¶ 3]. In October and November of 2024, Defendant began notifying individuals that their Private Information may have been accessed in the Data Incident. [Id. ¶¶ 32, 138]. On November 8, 2024, Plaintiff Russo filed a complaint against OnePoint asserting several causes of action related to its role in the Data Incident.3 [DE 1]. This Court consolidated the Russo action with another putative class action that was materially and substantively identical on January 10, 2025.4 Shortly thereafter, the parties began discussing potential settlement and scheduled a mediation with experienced class action mediator. [DE 30-1 at 241]. In advance of the mediation, Plaintiffs propounded informal discovery requests on OnePoint to which OnePoint responded by “providing information related to, among other things, the nature and cause of the Data Incident, the number and geographic location of victims impacted, the specific type of information breached, and the remedial measures implemented in response to the Data Incident.” [Id. See also DE 30-3 ¶ 8 (“Joint Declaration of Class Counsel”)]. The parties also exchanged mediation statements in advance of the mediation. [DE 30-1 at 241].

The parties participated in the formal mediation on April 9, 2025. Following a full day of negotiations, the parties reached an agreement on the material terms of a class wide settlement.

The material terms of the settlement and additional terms agreed to by the parties are memorialized in the Settlement Agreement. [DE 30-2].

On April 18, 2025, Plaintiffs Russo and Cobb filed the Consolidated Complaint, individually and on behalf of all others similarly situated, alleging negligence, negligence per se,

3 “Data Incident” means the cybersecurity incident that took place on or about August 8, 2024, involving the Defendant and resulting in the unauthorized access to or acquisition of Settlement Class members’ Private Information.” [DE 30-2 ¶ 30].

4 [See DE 19 (Order consolidating 3:24-cv-000649-RGJ (the “Russo Action”), DE 1 at 1, and 3:24-cv- 00695-RGJ (“Howey Action”), DE 1 at 2)]. breach of implied contract, unjust enrichment, breach of fiduciary duty, and for declaratory and injunctive relief.

B. Proposed Settlement Agreement The Settlement Agreement provides that OnePoint will pay $2,115,000 into a non- reversionary common fund (the “Settlement Fund”). [DE 30-1 at 242]. Following final approval, Plaintiffs will ask that up to one-third of the Settlement Fund be allocated to attorneys’ fees. They also will ask that CAFA notice and administration fees, litigation expenses, and a total of $5,000 in plaintiff service awards be deducted from this amount. [Id.]. The Class Members’ Valid Claim claims will then be paid out of the remaining sum. [DE 30-2 ¶ 97]. If monies remain in the Settlement Fund after the date the Class Members’ settlement checks expire, those monies will not revert to OnePoint but will be paid to a proposed cy pres recipient.5 [Id. ¶ 105].

There are approximately 528,452 potential settlement class members. [DE 30-1 at 242].

The Settlement Agreement proposes two alternate payment options. Under the “Cash Payment A” section, Class Members may submit claims for “up to $3,500” for “documented losses related to the Data Incident.” [DE 30-2 ¶ 70]. Class Members seeking compensation under this category will be required to provide reasonable supporting documentation. [Id.] In the event such a claim is deemed deficient (and cannot be cured after a reasonable opportunity), it will be treated automatically as a request for a “Cash Payment B – Alternate Cash.” [Id.] The Settlement Fund will be allocated as follows: (1) “[w]ithin 21 days following Preliminary Approval,” OnePoint shall pay the Settlement Administrator, Epiq Class Action & Claims Solutions, Inc. (“Epiq”), the “estimated Settlement Administration Costs and CAFA Notice”; (2) “within five days after the Defendant makes the final payment into the Settlement Fund,” the Settlement Administrator will pay out any Court-approved “Attorneys’ Fees and Costs,” as well as any “Service Awards” approved by the court and at the direction of Class Counsel; and (3) “[t]he Settlement Administrator shall distribute the Settlement Class Member Benefits no later than 30 days after the Effective Date or 30 days after the validity review of Cash Payments A is complete, whichever is later.” [DE 30-2 ¶¶ 67, 97, 102, 103]. Any residual funds (e.g., uncashed checks issued for Valid Claims) “shall be distributed to an appropriate mutually agreeable cy pres recipient approved by the Court.” [Id. ¶ 105].

The second option, for an “Alternate Cash” payment does not require any supporting documentation. Class Members who elect this option will simply submit a claim form indicating their choice. Notably, the Cash Payment B option is “subject to a pro rata increase in the event the amount of Valid Claims is insufficient to exhaust the entire Settlement Fund. Similarly, in the event the amount of Valid Claims exhausts the amount of the Settlement Fund, the amount of the Cash Payments will be reduced pro rata accordingly.” [Id. ¶ 70]. “Any pro rata increases or decreases . . . will be on an equal percentage basis,” calculated to ensure that the Settlement Fund is exhausted when the claims are paid out. [Id.].

Finally, in consideration for the benefits conferred to the Class Members, the Settlement Agreement provides that Class Members will release OnePoint from “any and all Released Claims, including but not limited to any state law or common law claims arising out of or relating to the Data Incident that the Releasing Parties may have or had.” [Id. ¶ 106].

C. Order to Supplement Plaintiffs moved for preliminary approval of the Settlement Agreement on May 23, 2025. [DE 30]. The Court ordered supplemental briefing, noting that the Court had “concerns about the adequacy of the proposed relief set forth in the Settlement Agreement.” [DE 31 at 413 (“Order to Supplement”)]. Specifically, the Court noted it [was] unable to balance the proposed relief against the value of the Released Claims. . . . [And] while it appear[ed] ‘that the court will likely be able to’ approve the proposed settlement as ‘fair, reasonable, and adequate’ and ‘certify the class for purposes of judgment on the proposal,’ some questions remain[ed] after the Sixth Circuit’s recent decision in [Speerly v. Gen. Motors, LLC, 143 F.4th 306 (6th Cir. 2025)]. [Id. at 413–16]. The Court ordered “Plaintiffs to file a supplemental memorandum addressing the foregoing concerns about the fairness of the settlement. . . . [and] addressing Speerly, including by identifying the elements of each cause of action.” [Id.]. The Court also ordered Plaintiffs to “to submit revised versions of the long-form notice and postcard notice” addressing certain deficiencies noted in the Order to Supplement. [Id. at 421].

III. STANDARD The claims of a “class proposed to be certified for purposes of settlement” may be settled “only with the court’s approval.” Fed. R. Civ. P. 23(e); see also Wayside Church v. Van Buren Cnty., Michigan, 103 F.4th 1215, 1222 (6th Cir. 2024). Under Rule 23(e), “class action settlement approval involves a three-step process”: (1) “preliminary approval of the proposed settlement,” (2) “notice of the settlement to all affected class members,” and (3) a “final approval hearing.” Garner Props. & Mgmt., LLC v. City of Inkster, 333 F.R.D. 614, 620 (E.D. Mich. 2020) (quotation mark omitted); see also Thacker v. Chesapeake Appalachia, LLC, 259 F.R.D. 262, 270 (E.D. Ky. 2009) (citing Tenn. Ass’n of Health Maint. Orgs., Inc. v. Grier, 262 F.3d 559, 565–66 (6th Cir. 2001)).

This case has reached the first step. The parties must “show[] that the court will likely be able to” both (1) approve the proposed settlement as “fair, reasonable, and adequate” and (2) “certify the class for purposes of judgment on the proposal.” Fed. R. Civ. P. 23(e)(1)–(2). “[I]f giving notice is justified by the parties’ showing,” the Court “must direct notice in a reasonable manner to all class members who would be bound by the proposal.” Fed. R. Civ. P. 23(e)(1)(B).

At step two, after receiving notice, “[a]ny class member may object to the proposal.” Fed. R. Civ. P. 23(e)(5)(A). At step three, a hearing must take place before the Court finally approves any class- action settlement. Fed. R. Civ. P. 23(e)(2).

IV. ANALYSIS A. Preliminary Approval of Proposed Settlement At this stage, “[t]he parties must provide the court with information sufficient to enable it to determine whether to give notice of the proposal to the class.” Fed. R. Civ. P. 23(e)(1)(A).

Notice will be given if the parties can show “that the court will likely be able to” (1) “approve the proposal under Rule 23(e)(2)” and (2) “certify the class for purposes of judgment on the proposal.”

Fed. R. Civ. P. 23(e)(1)(B).

For the reasons explained in the Order to Supplement, only two issues remain with respect to Plaintiffs’ motions: (1) the adequacy of the proposed relief provided to class members; and (2) whether Plaintiffs’ claims are likely to satisfy Rule 23(a)’s prerequisite of “commonality” in light of Speerly’s instruction that the district court “walk through each cause of action, identify the relevant elements, and evaluate which elements, if any, submit to common answers.” 143 F.4th at 31–17. i. Adequacy of Relief In determining whether the class-wide relief is adequate under Rule 23(e)(2)(C), the Court considers “the costs, risks, and delay of trial and appeal”; “the effectiveness of any proposed method of distributing relief to the class, including the method of processing class-member claims”; “the terms of any proposed award of attorney’s fees, including timing of payment”; and “any agreement required to be identified under Rule 23(e)(3).” 6 Fed. R. Civ. P. 23(e)(2)(C).

As noted in the Order to Supplement, the Court had two concerns related to the adequacy of the proposed relief in the Settlement Agreement: First, the record contains no direct evidence regarding the likelihood that the putative class would succeed on their claims. . . . Plaintiffs contend that data breach cases have ‘historically . . . face[d] substantial hurdles in surviving even the pleadings stage’ . . . . In particular, Plaintiffs identify ‘standing,’ untested ‘damages methodologies,’ and ‘causation’ as litigation risks. [Id.]. But these generalizations, standing alone, do not allow the Court to meaningfully evaluate ‘the costs, risks, and delay of trial and appeal’ as ‘required by Rule 23(e)(2)(C).

Second, Plaintiffs have not shown that the value of the proposed relief of approximately ‘$4 per person’ falls within the range of reasonableness given settlement amounts approved in comparable cases.

6 Plaintiffs report that there are no agreements to be identified under Rule 23(e)(3). [DE 30-3 ¶ 44]. [DE 31 at 408]. “On the other hand,” the Court found, “the remaining Rule 23(e)(2)(C) considerations weigh in favor of finding that the proposed relief is adequate.” [Id.].

Plaintiffs have addressed both concerns in the supplementary motion for preliminary approval. First, Plaintiffs explain that “[t]he risks of continued litigation in this case are particularly acute due to the unique nature of the Settlement Class.” [DE 39 at 440, 447]. Specifically, “virtually all of the class members are seeking end-of-life palliative care.” [Id. at 440]. As a result, there are inherent “costs [and] risks” associated with the “delay of trial and appeal” under Rule 23(e)(2)(C). In contrast, “[t]he Settlement ensures that meaningful compensation is delivered now, while it can still reach those the case was brought to protect.” [DE 39 at 441 (citing Ware v. CKF Enters., Inc., 2019 WL 2996914, at *1 (E.D. Ky. July 9, 2019) (quoting Dick v. Sprint Commc’n.

Co., L.P., 297 F.R.D. 283, 297 (W.D. Ky. 2014) (“[t]here is a strong public interest in encouraging settlement of complex litigation and class action suits because they are notoriously difficult and unpredictable and settlement conserves judicial resources.”)). Additionally, Plaintiffs have shown that the value of the proposed relief is likely adequate when compared to other settlements in the context of data breach class actions. [Id. at 447].

Second, Plaintiffs have provided further elaboration regarding the likelihood that the putative class would succeed on their claims. For instance, courts are split on whether, in cases such as this, allegations that a defendant “exposed sensitive PII/PHI and created a material risk of identity theft, fraud, and misuse” confers standing. [Id. at 441–42 n.3 (collecting cases)]. Plaintiffs have also identified “causation and traceability” defenses that OnePoint may raise if this case were to proceed to the motion to dismiss stage. [Id. at 443]. The Court finds that Plaintiffs have shown the proposed relief is likely adequate and thus this factor supports granting preliminary approval.

Accordingly, the factors are no longer “in near equipoise.” [DE 31 at 414]. For these reasons, as well as the reasoning in the Order to Supplement [DE 31], the Court finds that “the settlement is fair enough to begin the class-notice process.” Strano v. Kiplinger Washington Eds., Inc., 649 F. Supp. 3d 546, 553 (E.D. Mich. 2023) (citation modified). ii. Commonality Unfortunately, Plaintiffs fail to address Speerly, despite being instructed to do so in the Order to Supplement. [DE 31 at 418]. Although the Court previously credited Plaintiffs’ argument and found “that commonality is likely satisfied,” the Court expressly noted that “Plaintiffs have not addressed whether and to what extent Speerly changes the analysis.” [Id. at 417]. The Court specifically noted that “some questions remain after the Sixth Circuit’s recent decision in Speerly” and ordered “Plaintiffs to file a supplemental memorandum addressing Speerly, including by identifying the elements of each cause of action.” [DE 31 at 418].

Plaintiffs failed to follow the Court’s instructions. Indeed, Speerly is not cited in the supplement. To the extent Plaintiffs seek to argue that Speerly is inapplicable “[b]ecause this case has now been settled pending Court approval [and] the Court need not be concerned with issues of manageability relating to trial,” [DE 39 at 445], that is not the law. True, the Supreme Court has held that for settlement-only classes “a district court need not inquire whether the case, if tried, would present intractable management problems . . . for the proposal is that there be no trial.”

Amchem Prods., Inc. v. Windsor, 521 U.S. 591, 620 (1997) (emphasis added). But the Court went on to explain that “other specifications of the Rule—those designed to protect absentees by blocking unwarranted or overbroad class definitions—demand undiluted, even heightened, attention in the settlement context.” Id. Accord Int'l Union, United Auto., Aerospace, & Agr.

Implement Workers of Am. v. Gen. Motors Corp., 497 F.3d 615, 625 (6th Cir. 2007) (“Because Rule 23 is ‘designed to protect absentees by blocking unwarranted or overbroad class definitions,’ a district court must give ‘undiluted, even heightened, attention’ to its protections before certifying a settlement-only class.”)

The commonality requirement is more than a factor intended to ensure judicial economy at trial. Commonality “serve[s] as [a] guidepost[] for determining . . . whether the named plaintiff's claim and the class claims are so interrelated that the interests of the class members will be fairly and adequately protected in their absence.” Gen. Tel. Co. of Sw. v. Falcon, 457 U.S. 147, 158 n.13 (1982) (emphasis added). As noted in Speerly the commonality and predominance inquiries also protect absent third-parties from “coercive settlements” as the result of “incorrectly certified classes.” 143 F.4th at 324 (quoting Lab'y Corp. of Am. Holdings v. Davis, 605 U.S. 327, 145 (2025) (Kavanaugh, J., dissenting)). Failure to conduct “[a]n element-by-element comparison of a cause of action to determine whether common questions do, or do not, predominate . . . subverts the fairness . . . considerations underlying Rule 23.” Id. Accordingly, the Court is unable to grant preliminary approval at this time. The Court ORDERS Plaintiffs to file supplemental briefing on Speerly, consistent with the Order to Supplement.

B. Notice In response to the Order to Supplement, Plaintiffs “have updated the substance of the proposed Settlement Notices to resolve concerns raised by the Court.” [DE 39 at 448]. The Court is satisfied that the revised notices now identify the correct proposed class and “clearly and concisely state in plain, easily understood language . . . the class claims, issues, or defenses.” Fed. R. Civ. P. 23(c)(2)(B). The Court finds the proposed notices satisfy Rule 23(c)(2)(B) and that the Notice Program provides the best notice practicable under the circumstances, for each member of the class.

V. CONCLUSION For all these reasons, and the Court being otherwise sufficiently advised, IT IS ORDERED that, within 14 days of the entry of this Order, Plaintiffs shall supplement their Motion [DE 30] with additional briefing regarding the likelihood of class certification, consistent with this Opinion.

United States District Court April 29, 2026 Cc: counsel of record