ConnectOnCall Class Action Lawsuit
The $4.95M ConnectOnCall settlement covered people who contacted a doctor's after-hours line between 2014 and 2024. See what the claim form offered.
What happens next with the ConnectOnCall settlement
The claim deadline passed on November 2, 2026. New claims for this settlement are no longer being accepted.
A judge has not approved the settlement yet. That decision comes at a court hearing set for November 17, 2026, called the final approval hearing. Nothing is paid out before it.
Payments come after approval, and after any appeals. Anyone who objected to the settlement can ask a higher court to look at it again — an appeal — and that has to finish first. Eligible payments are sent once approval is final, and the stretch from a claim deadline to money in hand often runs a year or more. It varies from one settlement to the next.
Filed this claim with Chimo? The status of your claim is on the claims page in your account.
Settlements you can still claim in November 2026
Wayne Memorial Hospital
$25
Jefferson-Blount-St. Clair Mental Health Authority
$100
Laboratory Services Cooperative
$50
ConnectOnCall Class Action Lawsuit
People whose information was on the platform sued ConnectOnCall.com, LLC and Phreesia, Inc. in federal court in New York starting in December 2024, after a cybersecurity incident exposed private messages between patients and their healthcare providers. The lawsuits say the companies failed to protect that information; the companies deny it. ConnectOnCall was an after-hours on-call answering service — the system that handled your call when you phoned your doctor's office outside normal hours.
The lawsuit says an unknown attacker had access to the ConnectOnCall platform between February 16, 2024, and May 12, 2024, and copied data out of it, including certain provider-patient communications. The companies began notifying people who may have been affected on December 11, 2024.
Several near-identical lawsuits were filed. The court combined them on February 22, 2025, into one case, In re ConnectOnCall.com Data Breach Litigation, Case No. 2:24-cv-08790, in the United States District Court for the Eastern District of New York, before Judge Sanket J. Bulsara. On June 26, 2025, the court appointed five firms to run the case for the class: Kopelowitz Ostrow, Milberg, Morgan & Morgan, Lynch Carpenter, and Sultzer & Lipari.
The legal claims include negligence, negligence per se, breach of a third-party beneficiary contract, invasion of privacy, unjust enrichment, and a request for a declaratory judgment. The defendants deny doing anything wrong, and no court has decided that any law was broken. Both sides agreed to settle rather than keep litigating.
ConnectOnCall Class Action Settlement - $4,950,000
The companies agreed to pay $4,950,000 into a settlement fund. The fund is non-reversionary, which means none of it goes back to the companies — whatever the court approves is spent on class member benefits, administration, attorneys' fees, and awards to the people who brought the case.
The settlement class is every living person living in the United States whose private information may have been caught up in the incident. There is nothing to buy and nothing to return; what matters is whether your information was on the platform.
Every eligible class member who filed a valid claim could elect two years of dark web and medical data monitoring through CyEx Medical Shield Complete, which watches for a person's information turning up where it should not, sends real-time alerts, and carries up to $1,000,000 of insurance against medical identity theft. The settlement values that service at about $360 per person. Alongside it, claimants chose one of two cash options, described below.
The companies also agreed to give the class's lawyers a written statement, before the settlement is finalized, describing the security measures they put in place after the incident and what those measures cost. That spending is the companies' own and does not come out of the fund.
The deadline to file with Chimo was October 31, 2026, and the deadline on the official settlement website is November 2, 2026. The court will decide whether to approve the settlement at a hearing on November 17, 2026.
Claims closed: November 2, 2026
ConnectOnCall Class Action Payout: Up to $5,000
There were two cash options, and claimants picked one. Cash Payment A covers documented losses: real, out-of-pocket, unreimbursed costs a claimant could show came from identity theft, identity fraud, a falsified tax return, or other misuse of your information tied to this incident. It pays up to $5,000, and it required supporting paperwork the claimant did not write — receipts, account statements, notices, a police report. Cash Payment B is the alternate cash payment, an equal share of the net fund capped at $75, and it asked for no documentation at all.
If more valid claims came in than the fund can cover, the cash payments shrink proportionally. The settlement pays out in a set order when that happens: the monitoring service first, then Cash Payment A, then Cash Payment B. A Cash Payment A claim that is rejected, or that arrived without workable documentation, is converted to Cash Payment B rather than thrown out.
Nothing is paid until the settlement is final. The court holds its approval hearing on November 17, 2026, and the settlement becomes effective five days after the court's final order if nobody objects — longer if there are objections or an appeal. The settlement administrator then has 45 days to send out benefits.
Anything left in the fund after claims, costs, fees, and awards goes to two privacy nonprofits the parties have proposed: the International Association of Privacy Professionals and the Future of Privacy Forum. It does not return to the companies.
Data Breach Class Action Settlements
ConnectOnCall Class Action Eligibility
The settlement class covered living people in the United States whose private information may have been affected by the ConnectOnCall data incident. There was no purchase to prove and no minimum loss.
The one thing every claimant had to swear to was easy to miss: a declaration, under penalty of perjury, that they communicated after hours with a healthcare provider or their office between May 12, 2014, and May 12, 2024. That ten-year window is far wider than the four months the attacker was inside the system, so most people who used an after-hours line in that decade could make the declaration honestly.
A small group is excluded: directors, officers, and employees of the companies; and the judges on the case, their immediate families, and court staff. Anyone who asks to be excluded from the settlement gives up all benefits.
FAQ
An unknown attacker copied data from the ConnectOnCall platform, including certain provider-patient communications — the messages taken when you called your doctor's office after hours. The complaint says people now face a higher risk of identity theft and describes an increase in spam calls, texts and emails. The defendants deny the claims.
The attacker had access between February 16 and May 12, 2024, but the sworn declaration covered after-hours contact with a provider between May 12, 2014, and May 12, 2024. The wider window reflects how long communications sat on the platform.
No. Cash Payment A and Cash Payment B were alternatives, and claimants elected one. Everyone with a valid claim could take the dark web and medical data monitoring in addition to whichever cash option they choose.
It converts to Cash Payment B rather than being thrown out. If the claimant cannot supply workable documentation and does not fix the claim, it is treated as a claim for the alternate cash payment, which is capped at $75 and reduced if valid claims exceed the fund.
Yes. If valid claims exhaust the fund, cash payments are reduced proportionally. The administrator funds the monitoring service first, then Cash Payment A, then Cash Payment B — so the alternate cash payment absorbs any shortfall.
Class counsel will ask the court for attorneys' fees of no more than $1,650,000 plus costs — a third of the fund. They will also ask for up to $2,500 for each of the four people who brought the case. The court can award less.
Leftover funds go to two privacy nonprofits the parties proposed: the International Association of Privacy Professionals and the Future of Privacy Forum. The fund is non-reversionary, so nothing goes back to the companies.
You have 90 days from the day it is issued. After that the check is void and the money becomes residual funds — you forfeit it. Watch your mail in the weeks after the settlement becomes final.
Sources
These are the court's own records for this case. They are hosted here unchanged, so you can check anything on this page against the documents themselves.
- Class Action Complaint (PDF) Complaint · Filed December 24, 2024 · U.S. District Court for the Eastern District of New York · Case 2:24-cv-08790-SJB-JMW
The full case file is on the court docket: view the docket.