Jefferson-Blount-St. Clair Mental Health Authority Data Breach Settlement

Patients and employees of the Jefferson-Blount-St. Clair Mental Health Authority may claim. This settlement resolves claims over a cyberattack the Alabama mental health authority determined it had experienced on or about November 25, 2025; it gave public notice on January 23, 2026 and began mailing notice letters on or about March 9, 2026. The Settlement Agreement puts the class at about 29,486 people. Four things are worth getting straight before you file. First, the two cash payments are either-or, but the credit monitoring stacks on top of either. You choose either a flat $100 with no documents, or up to $5,000 in documented losses — not both; the Agreement says class members “must choose either Cash Payment A or Cash Payment B.” On top of whichever you pick, every class member may add three years of one-bureau credit monitoring and identity theft protection with at least $1,000,000 in identity theft insurance — free, no paperwork, and it does not reduce the cash. But it is not automatic; you have to check the box. Second, neither headline figure is guaranteed, because this is a capped $700,000 common fund and both cash payments are adjusted pro rata. The $100 is described throughout as “subject to pro rata increase or decrease,” and paragraph 72 applies pro rata adjustment to “Settlement Class Cash Payments” as a category — so a documented-loss award is exposed too. Using the Agreement’s own stated maximums, fees of up to 33.33% ($233,310) and Service Awards of up to $20,000 would leave no more than $446,690 before costs and administration, or roughly $15 per person if all 29,486 class members filed. That is SuitAlert’s arithmetic from the Agreement, not a projection by the parties, and the pro rata clause cuts both ways — payments are increased if few people claim. Third, do not mail the postcard tear-off if you want the $5,000 route. The tear-off form is for Cash Payment B only, and only one Claim Form may be submitted per class member, so mailing it is how people accidentally give up the documented-loss option. Use the online portal or the full downloadable Claim Form instead. Fourth, the opt-out and objection deadline is November 23, 2026 — a month before the December 23 claim deadline. Wait for the claim date to decide whether to stay in and the choice is gone. One genuinely favorable term, unusual for a breach settlement: a documented-loss claim that fails or is rejected and not cured is treated as a claim for the $100 rather than denied, so electing the documented route carries little downside. Note also that employees are in the class, not just patients, and that the $1,000,000 identity theft insurance figure is a coverage limit inside the monitoring product, not cash to the class.

Do I Qualify?

You may be eligible if:

• Your Private Information was determined to have been potentially impacted in the Data Security Incident the Authority determined on or about November 25, 2025. That is the class definition, and it expressly includes anyone who was sent a Notice Letter
• In practice, you received a postcard notice. Notice letters began going out on or about March 9, 2026, and the Settlement Agreement puts the class at approximately 29,486 individuals. The postcard carries the CPT ID and Passcode you need to file online
• You can be a patient OR an employee. The Settlement Agreement says the Authority held PII and PHI of “current and former patients and employees” — current and former staff on the Class List claim on the same terms as patients
• It has to be THIS entity. Jefferson-Blount-St. Clair Mental Health Authority, or JBS Mental Health Authority, is an Alabama non-profit established under Act 310 of the 1967 Legislature that coordinates mental health services for Region M-5 of the Alabama State Mental Health Plan. A different Alabama behavioral health provider with its own breach — including Highland Health Systems, which has a separate settlement — does not qualify you here
• Membership is not self-declared. The class covers people “determined to have been potentially impacted,” and the Authority supplies the Class List to CPT Group from its own records. Living in Alabama, or having had mental health care somewhere in Alabama, is not enough. If you think you are included but never got a notice, CPT Group will check: 1-888-716-0970 or JBSSettlement@cptgroup.com
• Any US state or territory. The class is defined as individuals residing in the United States or its territories, with no state restriction and no difference in benefits by state, though the case is in Jefferson County, Alabama and most class members will be Alabama patients and employees
• You do NOT need to have lost any money. The flat $100 requires no receipts and no explanation, and the three years of credit monitoring requires no documentation either. Proof is needed only if you claim documented losses instead of the $100
• You do NOT have to give up the credit monitoring to take cash. Three years of one-bureau monitoring with at least $1,000,000 in identity theft insurance may be claimed in addition to either cash payment and does not reduce it — but you must check the box, because it is not automatic
• But you DO have to choose between the two cash payments. The Agreement says class members “must choose either Cash Payment A or Cash Payment B” — the $100 or the documented losses, not both
• You can get your CPT ID. The online portal needs the CPT ID and Passcode; the mail-in Claim Form asks only for the CPT ID. Email JBSSettlement@cptgroup.com to request credentials if your postcard is gone
• You are not in an excluded group. The exclusions are narrow: the Authority’s governing board members, governmental entities, the Court along with its immediate family and staff, and anyone who timely and validly opts out
• A parent or legal guardian may submit a Claim Form on behalf of a class member who is a minor
• You file a valid Claim Form by December 23, 2026 — online by 11:59 p.m. Eastern time that day, or mailed with a postmark no later than that date. Note that November 23, 2026 is the separate, earlier deadline to opt out or object

There are two separate gates here and conflating them is the easiest way to lose a claim. Gate one: getting into a claim form at all — and the two routes are not gated the same way. The online portal at JBSSettlement.com opens with a login that requires both the CPT ID and the Passcode printed on the notice mailed to you. The downloadable mail-in Claim Form, by contrast, has a field for the CPT ID only — there is no Passcode field. That asymmetry is useful: unlike some data breach settlements where the printable form is gated identically to the portal, here mailing a form is a partial workaround if you have your postcard but cannot get the portal to accept your Passcode. You still need the CPT ID either way. If you do not have the credentials at all, the settlement website directs you to request them by emailing JBSSettlement@cptgroup.com, and the Long Form Notice adds the toll-free line 1-888-716-0970 for anyone who is not sure whether they are a class member. Do this well before December 23, 2026. The tear-off trap. The Postcard Claim Form attached to your notice is not the same document as the full Claim Form. It can claim Cash Payment B and credit monitoring only — the postcard says to return it “for Cash Payment B only” and directs documented-loss claimants to the website. Only one Claim Form may be submitted per class member, so mailing the tear-off forfeits the up-to-$5,000 route. Gate two: proving the benefit you picked. This splits cleanly by benefit. The three years of credit monitoring requires no documentation — just the checkbox. The flat $100 requires no documentary proof either; you submit a Claim Form signed under penalty of perjury. Only the up-to-$5,000 Cash Payment A needs records. What counts as documentation. The Agreement requires “reasonable third-party documentation” supporting the losses, and the Claim Form gives examples: credit card statements, bank statements, invoices, telephone records and receipts. It is explicit that “self-prepared” documents such as handwritten receipts, personal certifications, declarations or affidavits alone do not constitute proper documentation, though they may be included to add clarification, context or support for other reasonable documentation. You may redact unrelated transactions on a statement. The Claim Form also frames what makes a loss claimable: it should be an actual, documented and unreimbursed monetary loss, more likely than not caused by the incident, incurred on or after the date of the incident, and one the class member made reasonable but unsuccessful efforts to avoid or seek reimbursement for. Unlike many breach settlements, there is no closed list of eligible expense categories here. You will not be reimbursed for an expense already reimbursed by another source. Why the documented route is low-risk in this settlement. This is the opposite of most data breach settlements and it is the single most useful thing to know. The Agreement provides that if a class member does not submit reasonable third-party documentation supporting a loss, or the claim is rejected by the Settlement Administrator for any reason and the class member fails to cure it, “the Claim will be treated as if he or she elected Cash Payment B” — the $100. There is no outright denial for thin paperwork and no forfeiture of the flat payment, so if you have any genuine unreimbursed out-of-pocket losses there is little reason not to claim them. Every claim is signed under penalty of perjury under the laws of the United States, and the Settlement Administrator may require additional information to validate a claim, including questions about the validity of the signature. If you receive a Notice of Deficiency and do not respond, your claim may be determined not to be a Valid Claim.

What Happened?

The Jefferson-Blount-St. Clair Mental Health Authority, also known as JBS Mental Health Authority, is an Alabama non-profit corporation established under Act 310 of the 1967 Legislature. It is responsible for planning, coordinating and developing the system of mental health services for Region M-5 as established in the Alabama State Mental Health Plan, and it also provides consultation on program development and funding, coordination of regional programs, delivery of region-wide services, and a consolidated budgeting process.

In the course of operating its business the Authority collected and maintained personally identifiable information and protected health information belonging to current and former patients and employees, including names, Social Security numbers, dates of birth, health insurance information, medical record numbers, Medicare/Medicaid information, diagnoses, physician information, billing and claims information, prescription and medication information, and diagnostic and treatment information. Not every class member’s records contained every category.

On or about November 25, 2025, the Authority determined that it had experienced a cyberattack. It later reported that unauthorized access to its network occurred on or about November 25, 2025, and that certain files may have been subject to unauthorized access and/or acquisition. The Authority provided notice of the incident on its website and to local media outlets on January 23, 2026, and on or about March 9, 2026 began sending notice letters to potentially affected people.

Multiple putative class actions followed and were informally consolidated in the Circuit Court of Jefferson County, Alabama, Birmingham Division as Mykel Meyer, et al. v. Jefferson-Blount-St. Clair Mental Health Authority, Case No. 01-CV-2026-901158.00. An Amended Class Action Complaint was filed on May 11, 2026, alleging the Authority was negligent or otherwise responsible for failing to prevent the incident. The parties mediated with data breach mediator Phillip McCallum on June 5, 2026 and agreed on material terms that day.

The Court appointed Jonathan S. Mann of Pittman Dutton Hellums Bradley & Mann, P.C. as Class Counsel. There are eight Class Representatives — Mykel Meyer, Leatoya Bell, Bonnie Powell, Sharon Atwood, Joshua Mills, Jayda Adams, Amber Brasher on behalf of minor child C.J., and Amber Hildreth on behalf of minor child C.B. Class members are not charged for these lawyers. Defendant is represented by Jordan O’Donnell of Mullen Coughlin LLC.

The Authority denies all allegations and denies any wrongdoing or liability, and no court or other entity has made any judgment or determination of wrongdoing or that any law was violated. The parties settled to avoid the cost, burden, distraction and uncertainty of continued litigation.

This IS a capped common fund settlement, which matters for what you actually receive. The Authority agreed to a non-reversionary $700,000.00 Settlement Fund that pays cash payments, credit monitoring, settlement administration costs, Court-approved attorneys’ fees and costs, and Court-approved Service Awards. The Agreement provides that under no circumstances shall the Defendant be obligated to pay more than $700,000.00. Class Counsel may seek fees of up to 33.33% of the fund plus costs, and Service Awards of $2,500.00 for each of the eight Class Representatives, up to $20,000.00 in total. Cash payments are paid from the Net Settlement Fund and are adjusted pro rata on an equal percentage basis — up if valid claims do not exhaust the fund, down if they do. CPT Group, Inc. is the Settlement Administrator.

No funds revert to the Authority. If money remains in the Net Settlement Fund after the initial distribution, the Agreement provides for a second pro rata distribution to class members with valid claims where that distribution would be at least $5.00 per recipient; if a second distribution is not economically feasible, any remaining funds go to a Court-approved cy pres recipient.

Judge Chuck Price granted preliminary approval on August 25, 2026, and entered an amended preliminary approval order the same day. The schedule is set off the Notice Deadline: opt-out and objection deadlines fall 60 days after it and the Claim Form Deadline 90 days after it, producing November 23, 2026 and December 23, 2026 respectively. The amended order allows the Court to extend any of these deadlines for good cause.

The Final Approval Hearing is scheduled for February 16, 2027 at 10:30 a.m. before Judge Chuck Price at the Circuit Court of Jefferson County, Alabama, Birmingham Division, 716 Richard Arrington, Jr. Blvd. N., Birmingham, AL 35203. The notice warns the date and time are subject to change, with any change posted to JBSSettlement.com. Benefits are distributed only if the Court grants final approval and after the time for appeals has run — the Agreement calls for distribution no later than 75 days after the Effective Date, and checks must be negotiated within 90 days. The settlement website remains online for six months after final approval.

How to File Your Claim

1. FILE AT JBSSETTLEMENT.COM — the official settlement website, administered by CPT Group, Inc. Claims can be submitted online through the Submit Claim portal, or by mail on a paper Claim Form
2. THE ONLINE PORTAL NEEDS YOUR CPT ID AND PASSCODE, BUT THE PAPER FORM ONLY ASKS FOR THE CPT ID. Both come from the postcard notice mailed to you. The online login page requires the CPT ID and the Passcode
3. the downloadable mail-in Claim Form has a field for the CPT ID and no Passcode field. So unlike some data breach settlements, mailing a form is a partial workaround if you have the postcard but cannot get the portal to accept your Passcode. If you do not have the credentials at all, the settlement website directs you to request them by emailing JBSSettlement@cptgroup.com, and the Long Form Notice adds the toll-free line 1-888-716-0970. Do this well before the deadline
4. DO NOT MAIL THE POSTCARD TEAR-OFF IF YOU WANT THE $5,000 ROUTE. This is the single easiest way to lose money in this settlement. The tear-off Postcard Claim Form attached to your notice can claim only Cash Payment B (the $100 flat payment) and Credit Monitoring Services — the postcard says so in terms: "complete and return the attached Postcard Claim Form for Cash Payment B only," and "To submit a Claim for Documented Losses with supporting documentation, visit the Settlement Website." Only one Claim Form may be submitted per class member. To claim documented losses you must use the online portal or the full multi-page Claim Form downloaded from the Documents page
5. THE CLAIM DEADLINE IS DECEMBER 23, 2026. An online claim must be submitted by 11:59 p.m. Eastern time on that date
6. a mailed Claim Form must be postmarked no later than that date. Mail to: Jefferson-Blount-St. Clair Data Security Incident, c/o CPT Group, Inc., PO Box 19504, Irvine, CA 92623
7. WATCH THE EARLIER DEADLINE — NOVEMBER 23, 2026. Opting out and objecting both close a full month before claims do. An opt-out request must be personally signed and postmarked by November 23, 2026, and it is the only way to keep the right to sue the Authority separately over this incident. An objection must also be postmarked by November 23, 2026, and must be mailed to four separate addresses — the Clerk of the Court, Class Counsel, Defendant's Counsel and the Settlement Administrator
8. TICK THE CREDIT MONITORING BOX — IT IS NOT AUTOMATIC AND IT DOES NOT REDUCE YOUR CASH. Three years of one-bureau credit monitoring and identity theft protection with at least $1,000,000 in identity theft insurance has to be requested on the Claim Form. Every class member may elect it in addition to whichever cash payment they choose, and it requires no documentation
9. THEN PICK ONE CASH OPTION. The Settlement Agreement says class members "must choose either Cash Payment A or Cash Payment B." You cannot collect both the $100 and the documented losses
10. CLAIMING DOCUMENTED LOSSES IS LOW-RISK HERE, WHICH IS UNUSUAL. If you do not submit reasonable third-party documentation, or your Cash Payment A claim is rejected for any reason and you fail to cure it, the Settlement Agreement provides your claim "will be treated as if he or she elected Cash Payment B" — you fall back to the $100 rather than being denied outright
11. FILE ONLINE IF YOU WANT ELECTRONIC PAYMENT. The paper Claim Form states that a claim submitted on that form is paid by check
12. electronic payment such as PayPal, Venmo or direct deposit is available only through the website. Checks must be negotiated within 90 days
13. EVERY CLAIM IS SIGNED UNDER PENALTY OF PERJURY, and the Settlement Administrator may send a Notice of Deficiency or request additional information
14. failure to respond may mean your claim is not a Valid Claim
15. QUESTIONS: CPT Group, Inc. at 1-888-716-0970 or JBSSettlement@cptgroup.com
16. Visit the official claim form: https://www.jbssettlement.com/

How Much Will I Actually Get?

THE TWO CASH PAYMENTS ARE EITHER-OR; THE CREDIT MONITORING STACKS ON TOP OF EITHER. Get this straight before you file. The Settlement Agreement says that when submitting a claim for a Cash Payment, class members "must choose either Cash Payment A or Cash Payment B." Cash Payment A is reimbursement of up to $5,000.00 per class member for documented, unreimbursed losses related to the incident, supported by reasonable third-party documentation and an attestation under penalty of perjury. Cash Payment B is a flat $100.00 payment offered "as an alternative to Cash Payment A" and needs no documents. You pick one. The three years of one-bureau credit monitoring and identity theft protection, including at least $1,000,000.00 in identity theft insurance, is different: all class members may elect it "regardless of the type of Cash Payment selected," it requires no documentation, and it does not reduce the cash. But it is not automatic — you have to check the box. NEITHER HEADLINE DOLLAR FIGURE IS GUARANTEED, BECAUSE THIS IS A CAPPED COMMON FUND AND BOTH CASH PAYMENTS ARE ADJUSTED PRO RATA. This is the most important thing on this page. There is a single non-reversionary $700,000.00 Settlement Fund, and the Settlement Agreement states that "under no circumstances shall Defendant be obligated to pay or cause to be paid more than $700,000.00." Cash payments come out of the Net Settlement Fund — what is left after Court-approved attorneys' fees and costs, Service Awards, Settlement Administration Costs and taxes. Paragraph 72 then applies pro rata adjustment to "Settlement Class Cash Payments" as a category: payments rise pro rata if valid claims do not exhaust the Net Settlement Fund and are "reduced pro rata accordingly" if claims exhaust it, on an equal percentage basis. The $100 is described throughout the notice and claim form as "subject to pro rata increase or decrease based upon total Claim submissions," and on the face of paragraph 72 a documented-loss award is subject to the same adjustment. So the $100 could pay more than $100 if few people claim — or less. HOW LITTLE IS LEFT TO SHARE, BY ARITHMETIC. The deductions are capped by the Agreement, so the ceiling on the Net Settlement Fund can be worked out. Class Counsel may ask for attorneys' fees of up to 33.33% of the Settlement Fund — $233,310 — plus reimbursement of costs and expenses, and Service Awards of $2,500.00 for each of the eight Class Representatives, up to $20,000.00 total. Subtract only those stated maximums from $700,000 and no more than $446,690 remains, before any costs, administration or taxes. Spread across the roughly 29,486 class members, that is about $15 each if everyone filed a claim. This is SuitAlert's arithmetic from the Agreement's own figures, not a projection by the parties, and the Court may award less than the maximums — but it shows the $100 is a starting figure in a capped pot, not a promise. THE $5,000 IS A CAP ON ONE BENEFIT, NOT ON THE SETTLEMENT. The $5,000.00 ceiling applies per class member to Cash Payment A documented losses only. The cap on the settlement as a whole is the $700,000.00 fund. And the $1,000,000.00 figure attached to the credit monitoring is not money going to the class either — it is the identity theft insurance coverage limit bundled inside the monitoring product, which you would have to suffer a covered loss to touch. A GENUINELY FAVORABLE TERM: A FAILED DOCUMENTED-LOSS CLAIM FALLS BACK TO THE $100. Many data breach settlements simply deny a documented-loss claim with thin paperwork. This one does not. The Settlement Agreement provides that if a class member does not submit reasonable third-party documentation, or the claim is rejected by the Administrator for any reason and the class member fails to cure it, "the Claim will be treated as if he or she elected Cash Payment B." That makes electing Cash Payment A close to risk-free if you have any real out-of-pocket losses. WHAT DOCUMENTED LOSSES LOOK LIKE. Unlike many breach settlements, there is no closed list of eligible expense categories. The Claim Form describes a loss as one that is actual, documented and unreimbursed, more likely than not caused by the incident, incurred on or after the date of the incident, and where the class member made reasonable but unsuccessful efforts to avoid or seek reimbursement for it. There is also no separate payment for lost time in this settlement — no hourly or attested-hours benefit. And you will not be reimbursed for an expense already reimbursed from another source. NOTHING IS PAID UNTIL THE COURT APPROVES. The Final Approval Hearing is set for February 16, 2027 at 10:30 a.m. before Judge Chuck Price in the Circuit Court of Jefferson County, Alabama, Birmingham Division, and the notice warns the date and time are subject to change with any change posted to the settlement website. If the Court approves and no appeal is pending, the Agreement calls for benefits to be distributed no later than 75 days after the Effective Date. Checks must be negotiated within 90 days. No money reverts to the Authority: if funds remain after the initial distribution, the Agreement provides for a second pro rata distribution where that would be at least $5.00 per recipient, and any remainder goes to a Court-approved cy pres recipient.

Last reviewed: October 6, 2026 | Information verified from court records and official settlement documents.

Frequently Asked Questions