The Illinois Bone and Joint Institute, a musculoskeletal healthcare facility in the Chicago area that operates in several suburbs, started sending out letters in the mail that no one likes to open in the late summer of 2024. According to the letters, on or around July 4, 2024, IBJI discovered illegal access to its computer systems. A forensic analysis revealed that hackers had been within the network for roughly five weeks, from May 30 to July 4.
Patient data files had been duplicated. Names, residences, dates of birth, Social Security numbers, information on diagnoses and treatments, and health insurance details were among the personal data that was compromised; in other words, the full profile of a person’s financial and medical identity. The Department of Health and Human Services was first informed that about 183,000 people were impacted. After further research, that number was raised to roughly 568,000 present and past patients in the certified compensation class.
| Category | Detail |
|---|---|
| Case & Jurisdiction | Redman, et al. v. Illinois Bone and Joint Institute LLC, Case No. 2024-CH-08333; pending in the Circuit Court of Cook County, Illinois, County Department, Chancery Division; Final Approval Hearing scheduled July 1, 2026 at 10:30 a.m. CT before Judge William B. Sullivan, Courtroom 2410, Richard J. Daley Center |
| The Data Breach | Unauthorized access to IBJI computer systems occurred between May 30, 2024 and July 4, 2024; detected by IBJI on or around July 4, 2024; copied files included names, addresses, dates of birth, Social Security numbers, diagnosis and treatment information, and health insurance/claims data |
| Affected Population | Initially reported to HHS Office for Civil Rights as affecting approximately 183,000 individuals; amended total reached 665,321 individuals; the settlement class is approximately 568,000 current and former patients who received breach notice letters |
| Settlement Fund | $4,000,000 — covers attorneys’ fees and expenses, settlement administration costs, service awards to class representatives, and benefits for class members; IBJI denies all allegations but agreed to settle to avoid trial costs and risks |
| Available Benefits | Pro rata cash payment estimated at approximately $50 (final amount depends on total claims filed); reimbursement of up to $5,000 for documented out-of-pocket losses; two years of Kroll medical data monitoring services valued at approximately $240 per year (includes credit monitoring, dark web scanning, fraud specialist access, identity theft restoration, and up to $1,000,000 in identity fraud loss reimbursement) |
| Eligible Out-of-Pocket Losses | Monetary losses due to identity theft or fraud after May 30, 2024; credit monitoring costs; fees for freezing/unfreezing credit; postage and miscellaneous expenses for contacting financial institutions; only documented and unreimbursed costs traceable to the data incident |
| Critical Deadlines | Claim filing deadline: July 1, 2026; opt-out (exclusion) request postmarked by June 1, 2026; objections to settlement also due before final approval hearing; class members who do nothing receive no benefits and waive their right to sue separately |
| How to File & Reference | Online claim form at ibjisettlement.com (estimated 5–10 minutes to complete); mailed claims sent to Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391; toll-free phone (833) 447-8441; class members need their Class Member ID from the breach notice letter |
Lead plaintiff Guy Redman and other class representatives Bryan Wasserman, Gerard Ablin, Linda Kogen, Gary Kiefel, David Schultz, Jeff Fischer, Marianne Ajani, and Brian Holovaty filed a class action in the Circuit Court of Cook County, Illinois, under the caption Redman, et al. v. Illinois Bone and Joint Institute LLC, Case No. 2024-CH-08333. Negligence, implied contract violations, unjust enrichment, invasion of privacy, and violations of the Illinois Consumer Fraud and Deceptive Business Practices Act were all alleged in the complaint.
These are the typical legal theories that have been central to healthcare data breach litigation over the last five years. IBJI opted to settle in order to minimize the expense and risk of further litigation, even though they contested the accusations, as defendants in these situations usually do. The $4 million settlement puts this case in the center of the range for healthcare violations of this kind.
The settlement’s true benefits to class members are more complex than the headline figures imply. Depending on their circumstances, class members may choose to claim one, two, or all three of the available benefit categories. The final amount will depend solely on the number of claims filed; fewer claims will result in bigger payments per claimant, while more claims would result in smaller payments. The pro rata cash award is projected to be around $50 per class member.
Out-of-pocket loss reimbursement is limited to $5,000 and needs proof of actual financial impact that can be linked to the breach, such as identity theft fraud, credit freeze fees, monitoring expenses, and postage for contacting financial institutions. All class members, regardless of whether they have experienced identified losses, are eligible for the third option, which is two years of Kroll medical data monitoring services worth around $240 annually. Credit monitoring, dark web scanning, fraud specialist access, identity theft restoration services, and up to $1 million in identity fraud loss reimbursement are all included in the monitoring.
Due to the irreversible implications of missing deadlines, they require special attention. The deadline for filing claims is July 1, 2026, which is also the day of Judge William B. Sullivan’s Final Approval Hearing in Courtroom 2410 of the Richard J. Daley Center in downtown Chicago. Exclusion requests must be postmarked (not received) by June 1, 2026, the opt-out deadline for class members who choose to maintain their individual right to sue IBJI.
Members of the class who do nothing—that is, who get the breach notice letter and set it aside, who never submit a claim, or who never opt out—lose their opportunity to sue IBJI independently for this occurrence and do not receive any settlement benefits. This is the portion of class action settlements that yields the greatest no-claim rates and frequently surprises people.
Considering the larger trend of healthcare data breach settlements that have emerged between 2024 and 2026, it seems more likely that this approach will become the norm rather than the exception. Similar lawsuits have been settled by Chattanooga Heart Institute, Essen Medical Associates, and an increasing number of local healthcare providers using comparable arrangements: $3–5 million in settlement funds, roughly $50 in pro rata cash payments, up to $5,000 in documented losses, two years of credit, and medical monitoring through companies like Kroll.
It takes five to ten minutes for the qualifying patients to complete the online claim form, and while the sums are not life-altering, they are also not insignificant. Ibjisettlement.com is the official website. Kroll Settlement Administration is the settlement administrator. For assistance, call (833) 447-8441. On July 1, 2026, the window closes. There is still time for class members who got the notice letter, although it is limited.
