Brown Health Medical Group Data Breach Litigation
Case No. 1:26-cv-00473 (D.R.I.)
United States District Court for the District of Rhode Island
On August 28, 2026, Judge Melissa R. DuBose (United States District Court for the District of Rhode Island) consolidated seven related data-breach class actions against Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA, under our first-filed case, Tarvis v. Lifespan Physician Group of Massachusetts, No. 1:26-cv-00473-MRD-PAS. The underlying breach involved a December 2025 intrusion affecting a Brown Health file server, with 290,000-plus individuals affected.
Bryson attorney Scott Falgoust was appointed Interim Class Counsel – the lead role – with plenary authority to prosecute the claims of the plaintiffs and the putative class. The court also appointed a Liaison Counsel (Peter Wasylyk) and a six-member Plaintiffs’ Executive Committee.
Interim Class Counsel, in conjunction with Liaison Class Counsel and Plaintiffs’ Executive Committee, will be responsible for and have plenary authority to prosecute any and all claims of Plaintiffs and the putative class members.
Case Background
This is a class action arising out of a data breach that compromised the personal, financial, and protected health information of Plaintiff and hundreds of thousands of other patients of Brown Health, a multi-specialty, physician-led medical group that provides outpatient and ambulatory medical care in Massachusetts and the surrounding region. The breach happened in December 2025.
According to Brown Health, the information maintained on the affected server and placed at risk in the Data Breach included patients’ names, dates of birth, and contact information; health insurance information; billing, claims, and payment information; medical information; and, for at least some individuals, Social Security numbers, driver’s license numbers or other government-issued identification numbers, credit or debit card numbers, and financial account information. Brown Health has stated that not all categories of information were affected for every individual.
Plaintiffs allege that the data breach was a direct and foreseeable result of Brown Health’s failure to implement and maintain reasonable data-security measures appropriate to the sensitivity of the information it collected and stored, and consistent with well-established standards applicable to healthcare providers.
Plaintiffs further allege that the information Brown Health collects from patients is precisely the kind of information that criminals prize: durable identifiers and health information that cannot be cancelled or reissued and that can be exploited for years after it is stolen, and that Brown Health knew, or should have known, that this information was a target and that its compromise would expose patients to a serious and lasting risk of harm.