Albany Gastroenterology Consultants says information belonging to approximately 57,751 people was potentially affected by a 2024 breach. The proposed deal offers monitoring and cash…but plot twist! The cash is capped, doing nothing can still surrender legal claims, and several important terms remain inconsistent or unfinished.
TL;DR
- Albany Gastroenterology Consultants says a November 10, 2024 data breach potentially affected information associated with approximately 57,751 people.
- The proposed settlement creates two separate $100,000 cash pools: one for documented expenses and one for alternative cash payments, for a combined cash cap of $200,000.
- Eligible class members could claim up to $2,500 for documented, unreimbursed expenses or choose a nominal $10 alternative payment. Either category can be reduced proportionally if valid claims exceed its cap.
- The deal also promises two years of monitoring, but the core agreement describes one-bureau credit monitoring while its notice materials describe a medical-identity monitoring product.
- People who remain in the class but submit no valid claim would receive no benefit and would still release a broad range of breach-related claims.
- The supplied document contains only a proposed preliminary-approval order with blank dates and judicial signature lines. It does not establish that the court has approved the settlement.
The practical bargain is not simply “benefits for breach victims.” It is capped, claim-dependent relief in exchange for a broad release—and the court still must decide whether that bargain is fair.
Transparency Notice
This investigation relies on the supplied settlement agreement and its proposed claim forms, notices, and preliminary-approval order. The agreement recounts allegations made by Amanda Clements, Jessica Fasani, and Connie Cappello and states that Albany Gastro denies liability and wrongdoing. The attached court order is labeled “proposed,” contains unfilled dates, and is not signed by a judge. The source therefore does not establish preliminary or final judicial approval, liability, negligence, or wrongdoing.
The Facts
Albany Gastroenterology Consultants, PLLC is a medical practice based in Albany, New York, that specializes in diagnosing and treating gastrointestinal conditions. In that work, it collects and stores patient information.
According to the settlement agreement, the practice experienced a data breach on November 10, 2024. Its investigation concluded that names, addresses, medical information, medical-insurance information, Social Security numbers, and other personal or protected health information belonging to approximately 57,751 people were potentially affected.
The wording is not entirely uniform. The main agreement defines the incident as “potential unauthorized access,” while the proposed notice tells class members that files containing private information “were accessed.” The supplied material does not resolve that difference or explain precisely which records were viewed, copied, removed, or otherwise exposed.
Albany Gastro began sending breach notices on January 28, 2025. Lawsuits followed in New York state court. Those cases were consolidated, and the plaintiffs filed a consolidated complaint in May 2025.
The practice moved to dismiss that complaint in July 2025. A motion to dismiss asks a court to end claims because of a legal defect, generally before the parties have completed a trial. The source does not provide a ruling on that motion. Instead, the parties began settlement discussions and stayed the New York litigation while they negotiated.
The agreement says Albany Gastro supplied informal information about the breach’s nature and cause, the locations and number of affected people, and the types of information potentially accessed. That underlying material is not included in the supplied document, so its contents cannot be independently evaluated here.
How the Case Moved from New York to Florida
The settlement agreement identifies this as the date of the data breach.
Albany Gastro began sending notices to affected individuals.
Multiple proposed class actions began to be filed in Albany County, New York.
A New York court granted a request to consolidate the cases.
The plaintiffs filed a consolidated complaint.
Albany Gastro moved to dismiss; the plaintiffs opposed the motion, and the practice filed a reply.
The parties filed a stipulation to stay the New York case while pursuing settlement.
After dismissing the New York actions, the plaintiffs filed the Florida case identified as Clements v. Albany Gastroenterology Consultants, No. 2026-008885-CA-01.
The agreement says the parties decided during negotiations that venue was proper in Miami-Dade County, Florida. It does not provide a fuller explanation for moving litigation concerning a New York medical practice from New York state court to Florida.
The Florida complaint, as described by the agreement, alleges negligence, negligence per se, unjust enrichment, breach of implied contract, breach of fiduciary duty, and breach of confidence. Negligence per se is a theory under which violating a law designed to prevent a particular kind of harm can help establish a negligence claim. These remain allegations; the source contains no ruling that Albany Gastro committed any of them.
What the Proposed Settlement Actually Offers
The proposed class consists of people who received direct notice that their defined “Private Information” may have been compromised. Although the agreement initially describes several categories of potentially affected information, its formal definition of “Private Information” is narrower: names and Social Security numbers.
Class members would have to submit a valid claim to receive any payment or monitoring. They could seek the monitoring benefit in addition to one of two cash options.
Cash Payment A
Up to $2,500 for actual, unreimbursed expenses supported by documentation. Listed examples include fraud or identity-protection costs, professional fees, and credit-repair services.
The entire category is capped at $100,000. That pool is equivalent to only 40 claims paid at the full $2,500 maximum, although actual claims could be smaller and spread among more people.
Cash Payment B
A nominal alternative payment of $10 without proof of loss. A person cannot receive both Cash Payment A and Cash Payment B.
This category also has a $100,000 cap—enough for 10,000 payments at $10 before any proportional reduction becomes necessary.
“Pro rata” reduction means each approved payment in an oversubscribed category would be cut proportionally until the total fits within that category’s $100,000 limit. The $2,500 and $10 figures are therefore ceilings or starting points, not guaranteed payouts.
The agreement creates no single, fixed common settlement fund from which every expense must be paid. Albany Gastro separately agrees to pay valid cash claims, monitoring, settlement administration, court-approved legal fees, service awards, and certain other costs, subject to the specific terms and limits in the agreement.
The proposed settlement’s headline amounts describe what an individual may claim. The category caps determine what the class can collectively receive in cash.
There is also a timing inconsistency. The main agreement says reimbursable expenses must have been incurred between the date of Albany Gastro’s breach notice and the claim deadline. The proposed claim form instead says eligible losses may date back to November 10, 2024, the date of the breach. Those are not the same starting point, because the agreement says notices began on January 28, 2025.
The Monitoring Benefit Has Two Different Descriptions
Paragraph 67 of the main agreement promises two years of one-bureau credit monitoring with at least $1 million in fraud protection. One-bureau monitoring watches a person’s credit file at only one of the major credit-reporting companies rather than all of them.
The attached claim form and long-form notice describe something different: two years of CyEx Medical Shield Complete, with $1 million in medical-identity-theft insurance and monitoring for healthcare insurance identification exposure, medical-record-number exposure, and unauthorized Health Savings Account spending.
Both forms of monitoring may be useful, but they address different risks. Conventional credit monitoring looks for changes in a credit file. Medical-identity monitoring is designed to detect misuse of healthcare identifiers and accounts. The source does not clearly say whether class members would receive both, whether the exhibits supersede the general language, or whether the final product will be revised before notice is sent.
Why the distinction matters: A settlement notice should tell people exactly what they are receiving before they decide whether to claim benefits, object, opt out, or surrender claims.
Doing Nothing Still Carries a Legal Price
The settlement is “claims made,” meaning class members receive benefits only if they submit an approved claim. Remaining passive does not preserve their legal rights.
Unless a class member opts out by the court-approved deadline, the proposed release would extinguish a broad range of known and unknown claims connected to the breach. The released parties extend beyond Albany Gastro to a long list that includes Allied Health Management Services Organization, Gastrointestinal Care of Long Island, related entities, insurers, employees, contractors, officers, lawyers, advisers, and others.
Legal Receipts
“If a Settlement Class Member does not submit a Valid Claim, the Settlement Class Member will release his or her claims without receiving a Settlement Class Member Benefit.”Settlement Agreement, paragraph 65
“If you do nothing, you will not receive a benefit from this Settlement.”Proposed Long Form Notice, question 20
“Albany Gastro denies that it did anything wrong, and the Court has not decided who is right.”Proposed Long Form Notice
Opting out and objecting are different. A person who opts out receives no settlement benefit but preserves the ability to pursue an individual claim. A person who objects stays in the class and asks the court to reject or change the deal. If the settlement is approved despite the objection, that person remains bound unless they also completed a valid opt-out.
The proposed objection process is demanding. An objector would have to disclose, among other things, objections made by the person or their lawyers in other class actions during the previous five years. The agreement also says class and defense counsel may conduct limited discovery of an objector or the objector’s lawyer, including depositions and document requests.
The Claim-Review Rules Do Not Fully Agree with Each Other
Simpluris, Inc. is proposed as the settlement administrator—the outside company that would send notices, operate the settlement website and telephone line, review claims, and distribute benefits.
The agreement gives the administrator authority to reject incomplete, late, duplicate, unsupported, or potentially fraudulent claims. Claimants receiving a deficiency notice would generally have until the claim deadline or 15 days after that notice, whichever is later, to supply missing information.
One provision says a person whose claim is denied may seek review by a third-party claims referee. A later provision says the administrator’s decision to approve, deny, or reduce a claim is “final and binding.” The document does not explain how those provisions fit together or identify the referee, the review standard, or the procedure for requesting review.
Approved cash benefits would be distributed no later than 60 days after the settlement’s effective date. The effective date occurs only after final approval and the resolution or expiration of appeals. Paper checks would expire after 90 days. Funds that cannot be delivered because of incorrect or incomplete information would revert to Albany Gastro.
Security Improvements Are Promised but Not Described
Albany Gastro agrees to provide plaintiffs’ counsel with written confirmation of remedial measures and security enhancements implemented after the breach. The public-facing agreement does not identify those measures, establish minimum technical requirements, set an independent audit schedule, or say whether the confirmation will become public.
That leaves an important part of the proposed bargain difficult to evaluate. Cash can compensate some past expenses, and monitoring can identify some future misuse. Neither, by itself, explains what changed inside the systems that held the information.
The agreement also caps settlement administration costs—including any credit or medical monitoring—at $92,662. It does not provide a per-person cost, expected enrollment rate, vendor contract, or detailed budget showing how that figure was calculated.
Lawyers May Seek Up to $300,000
Class counsel may ask the court to award up to $300,000 in attorneys’ fees and litigation costs. Each of the three named plaintiffs may seek a service award of up to $2,500 for representing the class.
Those payments would be separate from the $200,000 cash cap and the benefits offered to class members. The agreement says fees and service awards were not negotiated until after the parties resolved the settlement’s other material terms.
A final approval hearing is where the judge would decide whether the settlement is fair, reasonable, and adequate, whether the class should be certified for settlement purposes, and how much to award the lawyers and class representatives. Settlement-only certification does not mean the court has found that the same class could proceed through a contested trial.
The Court Has Not Yet Approved the Deal in the Supplied Record
The agreement makes every major obligation conditional on court approval. Class counsel is supposed to request preliminary approval, after which notice would be sent and class members would receive deadlines to file claims, opt out, or object.
The attached preliminary-approval order is a proposed template. Its case number line, order date, final-hearing date, judge’s name, and judicial signature remain blank. Likewise, the proposed notices contain placeholder website addresses, telephone numbers, mailing addresses, and deadlines.
That means statements inside the draft notice saying that a court “has authorized this notice” should not be confused with evidence that authorization has already occurred. The supplied PDF shows language the parties want the court to approve, not an entered order proving that it did.
If the court rejects the settlement or imposes a change the parties will not accept, the agreement says the deal terminates and the litigation returns to its pre-settlement position. Albany Gastro would retain its defenses, and the plaintiffs would retain their claims.
What a Legitimate Fix Looks Like
Editorial analysisA notice that reconciles the documents
Before class members are asked to make binding decisions, the final agreement and notice should give one consistent description of the monitoring product, the eligible expense period, and the process for appealing denied claims.
Security terms that can be evaluated
A meaningful remediation commitment would identify the safeguards adopted, who verified them, when verification occurred, and what ongoing review is required—without publicly disclosing operational details that would create new security risks.
Transparent claims data
Final approval materials should disclose the number of notices delivered, claims submitted, claims approved and rejected, monitoring enrollments, projected proportional reductions, opt-outs, and objections. Those figures let the court compare advertised relief with likely real-world relief.
A review process ordinary people can use
The final documents should state plainly whether denied claims can be appealed, who decides an appeal, what evidence may be submitted, and whether that decision is final. A right to review that cannot be located or understood is not much of a right.
What to Watch
- Preliminary approval: Whether the Miami-Dade County Circuit Court enters an actual order authorizing notice and provisionally approving the settlement.
- Finalized notice details: The official settlement website, telephone number, mailing address, claim deadline, opt-out deadline, objection deadline, and hearing date are absent from the supplied draft.
- The monitoring product: Whether the final documents promise conventional one-bureau credit monitoring, medical-identity monitoring, or both.
- Expense eligibility: Whether reimbursable costs begin on November 10, 2024 or on the later date when Albany Gastro began sending notices.
- Claims review: Whether denied claimants receive third-party review despite the separate language describing administrator decisions as final.
- Participation and reductions: How many people submit valid claims and whether either $100,000 category cap reduces individual payments.
- Security evidence: Whether the promised confirmation of remediation provides enough information for the court and class to evaluate what changed.
- Final approval and fees: Whether the court approves the release, the settlement benefits, up to $300,000 in legal fees and costs, and the requested service awards.
What Remains Unresolved
The proposed deal supplies a framework, not a completed result. It does not establish exactly what happened to every affected record, whether the court considers the relief fair, how many people will claim benefits, or what each approved claimant will ultimately receive.
It also leaves several drafting conflicts that matter directly to class members: what kind of monitoring is included, when reimbursable expenses begin, and whether a rejected claim can receive independent review.
The most consequential unresolved issue is the exchange at the center of the agreement. People who do nothing may receive nothing while still losing breach-related claims. Whether capped cash, monitoring, and unspecified security improvements provide fair value for that release is the decision the court has yet to make.
The source document for this investigation is attached below.
