LOUISVILLE (LN) — A federal judge on Wednesday refused to preliminarily approve a $2.1 million settlement covering more than 528,000 people whose private health information was allegedly exposed in a 2024 data breach at a hospice pharmacy, ordering plaintiffs' counsel to address a controlling Sixth Circuit decision on class certification that they had failed to cite despite a prior court order requiring them to do so.
U.S. District Judge Rebecca Grady Jennings had already flagged the problem once, ordering plaintiffs in the consolidated suit against OnePoint Patient Care, LLC — a Kentucky-based pharmacy and pharmacy benefits manager serving over 40,000 hospice patients nationally — to brief the court on Speerly v. General Motors, LLC, a 2025 Sixth Circuit decision requiring district courts to walk through each cause of action element by element to assess whether commonality and predominance are satisfied.
Plaintiffs Christopher Russo and Shannon Cobb filed a supplemental brief. Speerly was not cited in it.
To the extent plaintiffs argued the manageability concerns animating Speerly evaporate once a case settles, Judge Jennings disagreed. Citing Amchem Products, Inc. v. Windsor, she wrote that while a district court need not worry about trial management for settlement-only classes, "other specifications of the Rule—those designed to protect absentees by blocking unwarranted or overbroad class definitions—demand undiluted, even heightened, attention in the settlement context."
The commonality requirement, she added, is not merely a trial-efficiency tool. Citing Speerly, she noted that the commonality and predominance inquiries also protect absent class members from coercive settlements resulting from incorrectly certified classes, and that failure to conduct an element-by-element comparison of a cause of action to determine whether common questions do or do not predominate subverts the fairness considerations underlying Rule 23.
The $2,115,000 non-reversionary fund would give class members two options: documented claims of up to $3,500 for losses tied to the breach, or a no-documentation alternate cash payment subject to pro rata adjustment based on total valid claims. Attorneys' fees would consume up to one-third of the fund, with $5,000 in plaintiff service awards and administration costs also drawn from the pot — leaving the per-person recovery at roughly $4 before any pro rata cuts.
Judge Jennings found the adequacy-of-relief question largely resolved by the supplemental briefing. Plaintiffs explained that virtually all class members are hospice patients seeking end-of-life palliative care, making litigation delay a particularly acute risk, and that the per-person value falls within the range approved in comparable data-breach settlements. The court also approved revised class notices as satisfying Rule 23's plain-language requirements.
The breach itself was discovered on or about August 8, 2024, when OnePoint noticed suspicious activity in its computer systems. The company began notifying affected individuals in October and November 2024 that their names, addresses, facility locations, and medical information may have been accessed.
Plaintiffs have 14 days from Wednesday's order to file the Speerly briefing the court has now requested twice.