A Florida federal judge has given preliminary approval to a $10 million settlement resolving claims that Watson Clinic LLP failed to safeguard patient information during a 2024 cyberattack that compromised hundreds of thousands of medical records and images.

U.S. District Judge Steven D. Merryday called the deal “fair, adequate and reasonable,” marking a major step toward closure in the class action accusing the Lakeland-based medical group of negligence, breach of contract, breach of fiduciary duty, and violations of Florida’s Deceptive and Unfair Trade Practices Act.

The agreement, proposed in July by plaintiffs Charles Viviani and David Thorpe, will compensate a class of 280,278 individuals whose data was exposed when hackers infiltrated Watson’s systems in January 2024.

Cash Awards Based on Sensitivity of Leaked Images

Under the settlement, Watson Clinic will create a nonreversionary $10 million fund to reimburse victims. Payments will range from $100 to $75,000, depending on the nature of the published medical images.

• Patients whose faces and “exposed sensitive areas” appeared online will receive $75,000.

• Those whose images show partial facial exposure and a sensitive area will get $40,000.

• Images revealing sensitive areas covered by undergarments will earn between $5,000 and $10,000, while minimal exposure images qualify for $100.

Each affected patient qualifies for a single, highest-tier payout—no claims needed for automatic digital payment, according to court documents.

Additional Compensation for Financial and Identity Losses

Victims can also file for out-of-pocket losses up to $500 to cover credit monitoring or fraud response costs. Those hit by identity theft or extraordinary financial harm may claim up to $6,500.

Additionally, participants may seek an extra $50 cash benefit on a claims-made basis. Remaining funds after all payments, fees, and administration costs will be redistributed to eligible claimants.

Beyond compensation, Watson Clinic agreed to implement new cybersecurity measures over the next three years. Specifics remain confidential due to their “sensitive nature.”

Judge Sets Timeline for Final Approval

Judge Merryday found that the proposed class met federal standards for certification, noting that all members share a common injury—Watson’s alleged failure to protect their personal information.

The court ordered that notice be sent by Nov. 7, with claims due Feb. 5, and objections or opt-outs by Jan. 6. A final fairness hearing is scheduled for March 9 to decide whether the deal will receive full approval.

Attorneys Patrick A. Barthle II of Morgan & Morgan and Gary M. Klinger of Milberg Coleman Bryson Phillips Grossman PLLC represent the plaintiffs.
Watson Clinic is defended by Alfred J. Saikali and Jennifer McLoone of Shook Hardy & Bacon LLP.

Neither side responded to requests for comment.