Harbour v. California Health & Wellness Plan

On or about March 24, 2021, the Health Net Defendants announced that in January 2021, an unauthorized user accessed information relating to certain Health Net Defendants’ members, including addresses, dates of birth, Social Security numbers, insurance identification numbers, and health information in a data breach involving the Health Net Defendants’ file transfer software vendor, Accellion. Specifically, the breach exploited vulnerabilities in Accellion’s file transfer product called the FTA, which allowed third parties to access information about certain customers and current and former employees of the Health Net Defendants.

The Plaintiffs claim that the Health Net Defendants failed to adequately protect their personal information and that they were injured as a result. The Health Net Defendants deny any wrongdoing, and no court or other entity has made any judgment or other determination of any wrongdoing or that the law has been violated. The Health Net Defendants deny these, and all other claims made in the Action. By entering into the Settlement, the Health Net Defendants are not admitting that they did anything wrong.

In a class action, one or more people called the Class Representatives sue on behalf of all people who have similar claims. Together all of these people are called a Class or Class Members. One court resolves the issues for all Class Members, except for those Class Members who exclude themselves from the Class.

The Class Representatives in this case are John Harbour, Tami Wisnesky, J. Doe, and Joweli Vunisa.

The Class Representatives and the Health Net Defendants do not agree about the claims made in this Action. The Action has not gone to trial and the Court has not decided in favor of the Class Representatives or the Health Net Defendants. Instead, the Class Representatives and the Health Net Defendants have agreed to settle the Action. The Class Representatives and the attorneys for the Class (“Class Counsel”) believe the Settlement is best for all Class Members because of the risks and uncertainty associated with continued litigation and the nature of the defenses raised by the Health Net Defendants.

If you received Notice of this Settlement, you have been identified by the Settlement Administrator as a Class Member. More specifically, you are a Class Member, and you are affected by this Settlement, if you received a notice from the Health Net Defendants that your personal information was compromised as a result of the FTA Data Breach.

Yes, the Settlement does not include:

1. the Judges presiding over the Action and members of their families;
2. the Health Net Defendants and Accellion, their subsidiaries, parent companies, successors, predecessors, and any entity in which the Health Net Defendants or Accellion or their parents have a controlling interest, and their current or former officers and directors;
3. Persons who properly execute and submit a Request for Exclusion prior to the expiration of the Opt-Out Period; and
4. the successors or assigns of any such excluded Persons.

The Settlement will provide Class Members with the opportunity to select and make a claim for one of following benefits:

• Cash Fund Payments in amounts to be determined in accordance with the terms of the Settlement; or
• Three years of Credit Monitoring and Insurance Services; or
• Cash Payments of up to $10,000 per Class Member for reimbursement of certain Documented Losses (“Documented Loss Payment”).

In addition, the Health Net Defendants have agreed to take certain remedial measures and enhanced security measures as a result of this Action.

In the alternative to a Cash Fund Payment, you may elect Credit Monitoring and Insurance Services. Credit Monitoring and Insurance Services provide a way to protect yourself from unauthorized use of your personal information. If you already have credit monitoring services, you may still sign up for this additional protection. The Credit Monitoring and Insurance Services provided by this Settlement are separate from, and in addition to, the credit monitoring and identity resolution services offered by the Health Net Defendants in response to the FTA Data Breach to individuals who received a notice letter from the Health Net Defendants. You are eligible to make a claim for the Credit Monitoring and Insurance Services being offered through this Settlement even if you did not sign up for the previous services.

Credit Monitoring and Insurance Services include:

1. up to $1 million of identity theft insurance coverage; and
2. three bureau credit monitoring providing notice of changes to the Participating Settlement Class Member’s credit profile.

The estimated retail value of the Credit Monitoring and Insurance Services product is $540.

To receive Credit Monitoring and Insurance Services, you must have submitted a completed Claim Form electing to receive Credit Monitoring and Insurance Services. As the Claims Filing Deadline has passed and payments in this matter have been issued, it is too late to submit a Claim Form.

In the alternative to a Cash Fund Payment or Credit Monitoring and Insurance Services, you may elect to submit a Claim Form for reimbursement of Documented Losses. If you spent money remedying or addressing identity theft and fraud that was more likely than not related to the FTA Data Breach, and was not reimbursable by insurance, or you spent money to protect yourself from future harm because of the FTA Data Breach, you may make a claim for a Documented Loss Payment for reimbursement of up to $10,000 in Documented Losses.

Documented Losses consist of unreimbursed losses incurred on or after January 20, 2021, that were related to identity theft and fraud and are more likely than not a result of the FTA Data Breach, as well as any expenses related to the FTA Data Breach. For example, credit card or debit card cancellation or replacement fees, late fees, declined payment fees, overdraft fees, returned check fees, customer service fees, credit-related costs associated with purchasing credit reports, credit monitoring or identity theft protection, costs to place a freeze or alert on credit reports, costs to replace a driver’s license, state identification card, Social Security number, professional services, and out-of-pocket expenses for notary, fax, postage, delivery, copying, mileage, and long-distance telephone charges. Other losses or costs related to the FTA Data Breach that are not insurance reimbursable may also be eligible for reimbursement. To protect the Settlement Fund and valid claims, all Claim Form submitted that seek payment related to credit or debit card fraudulent transactions will be carefully reviewed by the Settlement Administrator.

Claims for Documented Loss Payments must be supported by Reasonable Documentation. Reasonable Documentation means written documents supporting your claim, such as credit card statements, bank statements, invoices, telephone records, and receipts.

Individual cash payments may be reduced or increased pro rata depending on the number of Class Members that participate in the Settlement.

You must have submitted a completed Claim Form electing to receive a Documented Loss Payment. As the Claims Filing Deadline has passed and payments in this matter have been issued, it is too late to submit a Claim Form.

The amount of the Cash Fund Payment is $228.06 for California residents and $114.03 for all others. To receive a Cash Fund Payment, you must have submitted a completed Claim Form electing to receive a Cash Fund Payment. As the Claims Filing Deadline has passed and payments in this matter have been issued, it is too late to submit a Claim Form.

The remainder of the Settlement Fund, after payment of Court-awarded attorneys' fees, Class Representative awards, and settlement administration costs, were distributed in the following order:

1. Credit Monitoring and Insurance Services claims were paid first.
2. Documented Loss Payment claims were paid second.
3. The remaining Settlement Fund was paid as a pro-rata Cash Fund Payment to eligible claimants.

The Health Net Defendants have completed an investigation into the cause and scope of the FTA Data Breach and have ceased using the Accellion FTA and migrated to a new secure file transfer solution. Furthermore, as a result of the Action, for a period of five years, the Health Net Defendants have agreed to institute policies, procedures, and additional security-related remedial measures. These measures include enhancements to the Health Net Defendants’ third-party vendor risk management program and performing dark web monitoring for fraud, among other measures.

The Settlement provides a $10,000,000 Settlement Fund and remedial actions to be taken by the Health Net Defendants for the benefit of the Class. Any court-approved attorneys’ fees, costs, and expenses, Service Payments to the Class Representatives, taxes due on any interest earned by the Settlement Fund, if necessary, and any notice and settlement administration expenses will be paid out of the Settlement Fund, and the balance (“Net Settlement Fund”) will be used to pay for the above benefits.

Unless you exclude yourself, you are choosing to remain in the Class. If the Settlement is approved and becomes final, all of the Court’s orders will apply to you and legally bind you. You will not be able to sue, continue to sue, or be part of any other lawsuit against the Health Net Defendants and related parties about the legal issues in this Action resolved by this Settlement and released by the Class Action Settlement Agreement and Release. The specific rights you are giving up are called Released Claims (see FAQ 14).

In exchange for the Settlement, Class Members agree to release Health Net, LLC, Health Net of California, Inc., Health Net Life Insurance Company, Health Net Community Solutions, Inc., California Health & Wellness Plan, Centene Corporation, and CalViva Health and their respective predecessors, successors, assigns, parents, subsidiaries, divisions, affiliates, departments, and any and all of their past, present, and future officers, directors, employees, stockholders, partners, servants, agents, successors, attorneys, representatives, insurers, reinsurers, subrogees and assigns of any of the above, as well as Plaintiffs and Class Counsel (“Released Parties”) from any and all claims, causes of action, suits, obligations, debts, demands, agreements, promises, liabilities, damages, losses, controversies, costs, expenses and attorneys’ fees of any nature whatsoever, whether based on any law (including federal law, state law, common law, contract, rule, or regulation) or equity, whether known or unknown, suspected or unsuspected, asserted or unasserted, foreseen or unforeseen, actual or contingent, liquidated or unliquidated, punitive or compensatory, monetary or nonmonetary, that have been pled in the Action, or that could have been pled in the Action, that arise out of or relate to the causes of action, allegations, practices, or conduct at issue in the Complaint related to the Health Net Defendants, with respect to the FTA Data Breach (“Released Claims”).

The Released Claims do not include claims relating to the enforcement of the settlement. Released Claims do not include rights, causes of action, liabilities, actions, suits, damages, or demands of any kind whatsoever, known or unknown, matured or unmatured, at law or in equity, existing under federal or state law, against Accellion, Inc. and its predecessors, successors, assigns, parents, subsidiaries, divisions, affiliates, departments, and any and all past, present, and future officers, directors, employees, stockholders, partners, servants, agents, attorneys, representatives, insurers, reinsurers, subrogees, and assigns of any the foregoing entities listed in this sentence. No claims against Accellion are released and the litigation continues as to Accellion.

More information is provided in the Class Action Settlement Agreement and Release which is available here.

The claim filing deadline was December 22, 2023. Claims are no longer being accepted.

The claim filing deadline was December 22, 2023. Claims are no longer being accepted.

The claim filing deadline was December 22, 2023. Claims are no longer being accepted.

The claim filing deadline was December 22, 2023. Claims are no longer being accepted.

If you change your mailing address or email address after you submit a Claim Form, it is your responsibility to inform the Settlement Administrator of your updated information. You may notify the Settlement Administrator of any changes by calling 855-604-1678 or by writing to:

Health Net FTA Data Breach Settlement
P.O. Box 5983
Portland, OR 97228-5983

The Settlement Administrator sent information on how to activate Credit Monitoring and Insurance Services on March 27, 2024, and began to issue payments to valid Cash Fund Payment and Document Loss Payment claims on April 12, 2024. If you received a notice regarding Credit Monitoring and Insurance Services, keep it in a safe place as you will need the Unique ID provided on the Notice to activate your Credit Monitoring and Insurance Services.

None of the money in the $10 million Settlement Fund will be paid back to the Health Net Defendants. Any money left in the Settlement Fund 150 days after the distribution of payments to Class Members will be distributed pro rata among all Class Members with approved claims who cashed or deposited their initial check or received the Settlement proceeds through digital means, as long as the average payment amount is $3 or more. If there is not enough money to provide qualifying Class Members with an additional $3 payment, the remaining funds will be distributed to non-profit organizations, or “Non-Profit Residual Recipients.” The proposed Non-Profit Residual Recipient is the Electronic Frontier Foundation, a 26 U.S.C. § 501(c)(3) non-profit organization.

Approval of this Non-Profit Residual Recipient is subject to final court approval.

Yes, the Court has appointed Tina Wolfson, Robert Ahdoot, and Andrew Ferich of Ahdoot & Wolfson, PC, Laurence D. King, Matthew B. George, and Joel B. Strauss of Kaplan Fox & Kilsheimer LLP, and Timothy G. Blood, Paula R Brown, and Jennifer L MacPherson of Blood Hurst & O’Reardon, LLP as Class Counsel to represent you and the Class for the purposes of this Settlement.

Class Counsel was awarded, collectively, $2,500,000.00 in fees. Please see the Final Approval Order for details.

The deadline for exclusion requests was December 7, 2023.

The objection filing deadline has passed and the Settlement has received Final Approval.

The Court held a Final Fairness Hearing on January 11, 2024 and granted final approval to the Settlement on January 16, 2024.

If you are a Class Member and you do nothing, you will not receive any Settlement benefits. You will also give up certain rights, including your right to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against the Health Net Defendants or any of the Released Parties about the legal issues in this Action and released by the Settlement Agreement.

For more precise terms and conditions of the Settlement, please see the Settlement Agreement available here, or by contacting Class Counsel (see below), by accessing the Court docket in this case, for a fee, through the Court’s Public Access to Court Electronic Records (PACER) system at https://ecf.cand.uscourts.gov, or by visiting the office of the Clerk of the Court for the United States District Court for the Northern District of California (San Jose Division), Robert F. Peckham Federal Building, 280 South 1st Street, San Jose, California 95113, between 9:00 a.m. and 4:00 p.m., Monday through Friday, excluding Court holidays.

If you have questions about the proposed Settlement or anything in this Notice, you may contact Class Counsel at:

PLEASE DO NOT CONTACT THE COURT OR THE COURT CLERK’S OFFICE TO INQUIRE ABOUT THIS SETTLEMENT OR THE CLAIM PROCESS.