Alabama Ophthalmology Data Breach: Current Patient Guide
Updated: Oct 6
Reviewed and updated October 6, 2026.
Alabama Ophthalmology Associates confirmed that an unknown actor accessed and acquired personal or protected health information from its network between January 22 and January 30, 2025. The practice began notifying identifiable people on April 7, 2025.
A class action followed, and the parties proposed a settlement. The settlement claim deadline was July 6, 2026. As of this review, however, the settlement website still says the court “has to decide” whether to approve the settlement and does not post a final-approval result. That public-site gap prevents this article from responsibly stating that approval is final, appeals are over, or payments have begun.
What Alabama Ophthalmology confirmed
The practice’s April 7, 2025 notice says:
it detected unusual network activity on January 30, 2025;
an unknown actor accessed and acquired information without authorization from January 22 through January 30;
its review of the affected files concluded on March 19; and
potentially affected information included names, dates of birth, Social Security numbers, health-insurance information, treatment information, medical-record numbers, and medical-history information.
The notice cautions that not every data element was involved for every person. It does not give a reconciled total of affected people. Counts appearing in lawsuits, databases, or news reports should not be substituted for what a particular notice recipient was told.
What the proposed settlement says—and does not say
The court-authorized settlement website identifies the case as In re Alabama Ophthalmology Associates, P.C., Data Breach Litigation, No. CV-2025-901488.00, in the Circuit Court of Jefferson County, Alabama. It defines the proposed settlement class as U.S. residents whom Alabama Ophthalmology notified that their information may have been affected.
The site describes, if the settlement becomes effective, two years of medical-data monitoring and identity-theft protection, plus one of two cash options: documented out-of-pocket losses up to $5,000 or a pro rata payment estimated at $60. It says Alabama Ophthalmology denies wrongdoing and that the court has not decided which side is right.
Those statements are settlement terms and party positions, not findings that Alabama Ophthalmology was negligent or that any individual suffered identity theft. Conversely, a settlement does not erase the confirmed fact that the practice reported unauthorized access and acquisition of information.
The claim deadline has passed
The online claim-form page now states that the deadline has passed. This article does not suggest that a late submission will be accepted.
People who filed a claim should keep their confirmation, supporting documents, and any message from the administrator. They should use the official settlement website for updates or contact the administrator at 833-244-7341. Anyone considering action outside the settlement should obtain advice about releases, deadlines, and the effect of remaining in or excluding oneself from the class; those questions cannot be answered from a general article.
Steps patients can still take
Whether or not a person filed a settlement claim, these measures remain practical:
Preserve the breach letter, envelope, claim confirmation, and proof of any expenses.
Review credit reports, bank and card statements, medical bills, insurance explanations of benefits, and portal activity for unfamiliar entries.
Consider the FTC’s credit-freeze and fraud-alert options. A freeze is free and must be placed with each bureau.
If identity theft occurs, use IdentityTheft.gov for a recovery plan and preserve every dispute, receipt, and result.
If a medical record or benefits history is wrong, contact the provider or insurer through a verified channel and request the correction in writing.
HHS also explains how to file a health-information privacy or security complaint. HHS ordinarily requires a complaint within 180 days of when the person knew of the act or omission, subject to a possible good-cause extension. That administrative process is different from a civil damages claim.
A claim requires more than a notice
The most useful evidence is concrete: a fraudulent account, tax problem, medical-identity entry, denied benefit, paid monitoring expense, replacement-document cost, or time spent responding to verified misuse. The notice identifies risk; it does not prove that a listed harm occurred to every recipient.
If you have documented misuse or an unreimbursed loss tied to this incident, preserve the administrator record and supporting documents and request an initial case evaluation. For a separate vendor-side hospital incident, see the Huntsville Hospital Cerner breach guide.
Primary sources
This article provides general information, not legal advice. Settlement and breach information can change; use the linked administrator, entity, and agency pages for current instructions. Reading this article or contacting the firm does not create an attorney-client relationship. Representation begins only after the firm accepts the matter in writing. Do not send Social Security numbers, account numbers, passwords, medical records, confidential information, or time-critical material through a website form.
