This case involves a data security incident against Norwood’s computer systems that contained personal identifying information and private health information (“Private Information”) that Norwood provided notice of on March 8, 2022 (“Cyber Incident”). You are part of this Settlement as a Settlement Class Member if your Private Information was potentially compromised in the Cyber Incident or you previously received a notification from Defendant pertaining to the Cyber Incident. Members of the Settlement Class, defined below, will be affected.

The Plaintiffs and Defendant will ask the Court to certify a Settlement Class defined as “all individuals residing in the United States whose personal information was or may have been compromised in the data breach that is the subject of the data security incident notice that Defendant sent to Plaintiffs and others in substantially the same form on or around March 8, 2022.” The Settlement Class specifically excludes: (i) Norwood Clinic and its officers and directors; (ii) all Settlement Class Members who timely and validly request exclusion from the Settlement Class; (iii) the Judge assigned to evaluate the fairness of this settlement; and (iv) any other Person found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding, or abetting the criminal activity occurrence of the Cyber Incident or who pleads nolo contendre to any such charge.

If the Settlement does not become effective (for example, because it is not finally approved, or the approval is reversed on appeal), then this litigation will continue.

In September 2021, cybercriminals were able to gain access to Norwood’s computer systems, encrypt certain servers, and potentially accessed without authority Norwood data files that contained current and former patient information. The Lawsuit claims that Norwood was responsible for failing to prevent the Cyber Incident and asserted legal claims such as negligence, negligence per se, invasion of privacy, breach of express and implied contract, unjust enrichment, breach of fiduciary duty, breach of confidence, bailment, invasion of privacy, and violation of Alabama’s Data Breach Security Notification Law.

Norwood has denied and continues to deny all of the claims made in the Lawsuit, as well as charges of wrongdoing or liability against it.

The Court did not decide in favor of the Plaintiffs or Norwood. Instead, Plaintiffs negotiated a settlement with Norwood that allows both parties to avoid the risks and costs of lengthy and uncertain litigation and the uncertainty of a trial and appeals. It also allows Settlement Class Members to obtain payment and credit monitoring services without further delay.

Settlement was attained only after Plaintiffs’ Counsel conducted a thorough examination and investigation of the facts and law relating to the matters in the Lawsuit, which included extensive informal discovery, requesting and receiving documents from Defendant, examining Defendant’s documents, and questioning Defendant regarding its documents. The parties also engaged a neutral, third-party mediator to assist in the negotiations.

Representative Plaintiffs and Class Counsel believe that the terms of the Settlement are fair, reasonable, adequate, and equitable, and that the Settlement is in the best interest of the Settlement Class Members. The fact that there is a settlement does not mean that Defendant admits it did anything wrong.

All Settlement Class Members are eligible to receive free credit monitoring services and compensation for lost time and out-of-pocket losses resulting from the Cyber Incident. To receive benefits from the Settlement, you must complete and return a Claim Form that is available on this Settlement Website, or you can call the Settlement Administrator at 1-877-495-0904 to request a copy be mailed to you.

There are two kinds of Settlement benefits available. You may receive:

A. Up to $1,625 in recovery of any Out-of-Pocket Losses and/or Lost Time that you have suffered as a result of the Cyber Incident. This money will be provided as reimbursement for the following types of losses:

• Up to $1,125 in Out-of-Pocket Losses. You are eligible to receive reimbursement for money you paid to protect yourself after the Cyber Incident, such as money spent on a credit monitoring service. You are also eligible to receive reimbursement for money you lost as a result of fraud or identity theft. Any losses claimed must be “fairly traceable” to the Cyber Incident, meaning (1) the timing of the loss occurred on or after October 1, 2021 (or the earliest verifiable date the cyber incident occurred); and (2) the personal information used to commit identity theft or fraud consisted of the same type of personal information that was provided to Defendant prior to the Cyber Incident. To receive reimbursement for these expenses, you must attach documentation that reasonably supports the claimed losses.

• Up to $500 of Lost Time. You are eligible to receive compensation for time that you spent attempting to mitigate the effects of the Cyber Incident on your life. This can include, for example, time spent on the phone with banks, time spent dealing with replacement card issues or reversing fraudulent charges, time spent researching the Cyber Incident, time spent monitoring accounts, or time spent freezing your credit. You will be reimbursed for your time at $25/hour for up to twenty (20) hours, but you can only make a claim for lost time if at least one full hour was spent. To prove your lost time, you may either sign and attest that you spent the lost time, or you can provide documentation that supports the lost time (such as phone records).

B. Free Credit Monitoring. The Credit Monitoring and Insurance Services will include the following services, among others: (1) dark web scanning with immediate user notification if potentially unauthorized use of a class member’s personal information is detected; (2) identity theft insurance; (3) real-time credit monitoring with Equifax, Experian, and TransUnion; and (4) access to fraud resolution agents. To enroll in the Free Credit Monitoring, you must sign and submit a valid Claim Form.

Cash Payments will be paid by electronic transfer or by check sent via First-Class Mail to the mailing address you provide on the Claim Form. Instructions are provided on the Claim Form.

To participate in the settlement, you must submit a Claim Form. The Claim Form itself contains directions on how to fill it out. The Claim Form will require you to submit documents that prove your claim. For your Out-of-Pocket Expenses, you must submit independent supporting documentation, such as receipts, showing those expenses. For your Lost Time, you may submit either an affidavit or independent supporting documentation as proof.

To make a Claim for compensation for lost time, out-of-pocket losses, and/or free credit monitoring services, you must complete, sign, and submit the Claim Form. Claim Forms are available on this Settlement Website, or you can call the Settlement Administrator at 1-877-495-0904 to request a copy be mailed to you. You can submit the Claim Form online, or you can mail it to the Settlement Administrator at: Norwood Clinic Inc. Cyber Incident Settlement, c/o A.B. Data, Ltd., P.O. Box 173105, Milwaukee, WI 53217. Claim Forms must be submitted online or delivered to the Settlement Administrator by 11:59 p.m. Central Standard Time on March 20, 2024, or postmarked by March 20, 2024 if mailed.

The Court will decide whether to approve the settlement at a Final Approval Hearing. That hearing is currently scheduled for April 22, 2024. If the Court approves the Settlement and there are no appeals, then within thirty (30) days of the Effective Date of the Settlement, the Settlement Administrator shall make best efforts to provide enrollment instructions for the free Credit Monitoring Services to Settlement Class Members who selected Credit Monitoring Services on their Claim Forms for all Approved Claims. In addition, cash settlement payments will be issued: (i) within sixty (60) days after the Effective Date provided in the Settlement Agreement; or (ii) the date when all Claim Forms have been processed subject to the terms and conditions of the Settlement, whichever date is later.

Prior to the Final Approval Hearing, Class Counsel will ask the Court to award their reasonable attorneys’ fees in an amount not to exceed $700,000.00 and litigation costs not to exceed $20,000.00.

In addition, the four (4) Representative Plaintiffs in this case will apply to the Court for a Service Award up to $4,500 each. This payment is designed to compensate Plaintiffs for the time, effort, and risks they undertook in pursuing this litigation on behalf of all the Settlement Class Members.

The Court will ultimately determine and approve the amount of Attorneys’ Fees and Costs, as well as the amount of the Service Award, to be awarded to Plaintiffs and Class Counsel.

If you are a Settlement Class Member and you do not Opt Out of the Settlement, you will be legally bound by all orders and judgments of the Court, and you will also be legally bound to the Releases of the claims in the Settlement Agreement. This means that in exchange for being a Settlement Class Member and being eligible for the benefits of the Settlement, you will not be able to sue, continue to sue, or be part of any other lawsuit against Norwood and/or any of the Released Parties that involves the same legal allegations as those resolved through this Settlement.

You can Opt Out of the Settlement Class if you wish to retain the right to sue Defendant separately about issues in the Lawsuit or otherwise related to the Cyber Incident. If you Opt Out, you cannot file a Claim or Object to the Settlement.

To Opt Out, you must individually sign and timely submit written notice of such intent to exclude yourself from the Settlement in Kathy L. Limbaugh, et. al. v. Norwood Clinic, Inc., 01-CV-2022-900851.00. The written notice must have the case name and number and clearly manifest your intent to be excluded from the Settlement Class. Your exclusion request must also include your name, address, and signature. To be effective, your written notice must be either electronically submitted on this Settlement website, or sent by mail to the Settlement Administrator at the address below and postmarked no later than February 19, 2024.

If you are a Settlement Class Member, you can object to the Settlement if you do not like it or a portion of it. You can give reasons why you think the Court should not approve the Settlement by filing an Objection with the Court before the deadline has passed. You can’t ask the Court to change the terms of the Settlement or order a larger Settlement Benefit; the Court can only approve or disallow the Settlement as it is written. If the Court does not approve the Settlement, then Cash Payments will not be paid, the Injunctive Relief will not be ordered, and the Lawsuit will continue in litigation.

You can also ask the Court to deny Class Counsel’s request for Attorneys’ Fees and Costs and the Service Awards. If the Court does not approve those payments, then Plaintiffs and/or their counsel will not get paid.

You may appear at the Final Approval Hearing, either in person or through your own attorney. If you appear through your own attorney, you are responsible for paying that attorney. If you want to raise an objection to the Settlement at the Final Approval Hearing, you must first submit that objection in writing to the Clerk of the Court as set forth below. Your objection must be postmarked and received on or before the Objection Deadline.

To be timely, written notice of your objection in the appropriate form must be filed with the Clerk of the Court no later than sixty (60) days after the Notice Date of February 19, 2024, and served concurrently therewith upon Proposed Settlement Class Counsel (Attn: Jon Mann, Pittman, Dutton, Hellums, Bradley & Mann, P.C., 2001 Park Place, Suite 1100, Birmingham, AL 35203); and counsel for Norwood (Attn: Jennifer Stegmaier, Wilson Elser Moskowitz Edelman & Dicker, LLP, 55 West Monroe Street, Suite 3800, Chicago, Illinois 60603).

All written objections and supporting papers must clearly include: (i) the case name and number; (ii) the objector’s full name, current mailing address and telephone number, and any email address; (iii) a signed statement by the objector that he or she believes they are a member of the Settlement Class; (iv) a statement of the specific grounds for the objection, as well as any documents supporting the objection; (v) the identity of any attorneys representing the objector; (vi) a statement regarding whether the objector or his/her attorney intends to appear at the Final Approval Hearing; (vii) specificity as to whether the objection applies only to the objector, a subset of the Settlement Class, or the entire Settlement Class; (viii) a list of all persons who will be called to testify at the Final Approval Hearing in support of the objection; (ix) a list, by case name, court, and docket number, of all other cases in which the objector and/or the objector’s counsel has filed an objection to any proposed class action settlement within the last three (3) years; (x) a list, by case number, court, and docket number, of all other cases in which the objector has been named a plaintiff in any class action or served as a lead plaintiff or class representative; and (xi) the signature of the objector and his/her attorney. The Notice will inform Settlement Class Members that to be considered timely and valid, all objections must be filed with the Clerk for the Jefferson County Circuit Court no later than sixty (60) days following the Notice Date. The Notice will further inform Settlement Class Members that, to be considered timely and valid, they must mail a copy of their objection to the following different places, postmarked no later than sixty (60) days after the Notice Date:

You can file a Claim even if you object to the Settlement. If you want to receive benefits in the event that the Court approves the Settlement, then you must submit a Claim Form according to the instructions described above.

The Court will hold a hearing on April 22, 2024, to consider whether to approve the Settlement. The hearing will be held in the Jefferson County Circuit Court before Judge Monica Y. Agee at Circuit Court of Jefferson County, Alabama, Birmingham Division, 716 Richard Arrington, Jr. Boulevard North, Birmingham, AL 35203 and may also be held virtually.

The hearing is open to the public. This hearing date and location may change without further notice to you. Consult the Settlement Website for updated information on the hearing date and time. However, if you want to speak at the Final Approval Hearing you must submit a request to the Court and follow the instructions above for objecting to the Settlement. You cannot speak at the hearing if you exclude yourself from the Settlement.

You can inspect many of the court documents connected with this case on the Settlement Website.

You can contact the Settlement Administrator at Norwood Clinic Inc. Cyber Incident Settlement, c/o A.B. Data, Ltd., P.O. Box 173105, Milwaukee, WI 53217, or by telephone at 1-877-495-0904.

PLEASE DO NOT CONTACT THE ATTORNEYS FOR NORWOOD CLINIC, INC. WITH QUESTIONS.