On Feb. 1, 2022, a magistrate judge of the U.S. District Court for the Western District of New York recommended the dismissal of a class-action lawsuit against Practicefirst, a medical management company, citing insufficient evidence of actual harm from a ransomware attack.^[1]

The defendant, Practicefirst, which provides billing, credentialing, coding, and auditing services to 75 providers across the country, experienced a ransomware attack in December 2020. The ransomware attack affected more than 1.2 million patient files that contained personal health information (PHI) and personally identifiable information (PII). After conducting a forensic investigation, the defendant notified affected persons, including plaintiffs, in June and July 2021.