As of September 19, 2026, this article’s data breach section is outdated. A settlement was reached in Turner et al. v. Johns Hopkins Health System Corporation, Case No. 24-C-23-002983 (Circuit Court for Baltimore City, MD), resolving the 2023 MOVEit-related data breach claims for the 363,885 individuals affected. The settlement fund totaled $2.9 million, with a claims deadline of September 12, 2024, and a final approval hearing held September 26, 2024 — well before this update. This specific case is no longer accepting new claims. Readers in 2026 searching for an “active” Johns Hopkins data breach claim window should know this particular settlement has already moved through its claims process, contrary to the “settlement TBD” language elsewhere in this piece.
Last updated: September 2026
The Johns Hopkins lawsuit resulted in one of the largest medical abuse settlements in U.S. history: $190 million paid to thousands of patients harmed by a physician who secretly recorded them during private exams. If you or someone you know was a patient at Johns Hopkins, this article covers every key detail you need in 2026.
There are actually two major legal actions connected to Johns Hopkins. The first involves the abuse committed by Dr. Nikita Levy. The second involves a major data breach in 2023 that exposed patient records.
Both cases raised serious questions about how a world-famous institution failed to protect the people who trusted it most. Here is exactly what happened, who qualifies, and what the money looks like.
What Is the Johns Hopkins Lawsuit?
The Johns Hopkins lawsuit refers primarily to the civil class action brought against Johns Hopkins Medicine for the actions of Dr. Nikita Levy, a gynecologist employed by the hospital who secretly recorded patients during pelvic exams over nearly two decades.
The case was filed in U.S. District Court for the District of Maryland. It was one of the largest physician abuse cases in American history, both in terms of the number of victims and the final settlement value.
A separate Johns Hopkins lawsuit also arose from a 2023 data breach that exposed the personal and medical records of roughly 310,000 patients. That breach was connected to the MOVEit file transfer software hack carried out by the Cl0p ransomware group.
| Case | Core Issue | Approximate Victims |
|---|---|---|
| Dr. Nikita Levy Abuse Case | Secret recordings during gynecological exams | ~8,000 patients |
| 2023 MOVEit Data Breach | Patient data exposed via software vulnerability | ~310,000 individuals |
Both cases matter. Both affected real people. And both have legal processes that are still relevant heading into 2026.
Johns Hopkins Lawsuit Explained: The Full Background
Johns Hopkins Medicine is one of the most respected hospital systems in the world. That reputation made what happened under its roof even harder to process.
Dr. Nikita Levy worked as a gynecologist at Johns Hopkins East Baltimore Medical Center for 25 years. During that time, he used a pen-shaped camera hidden on his body to secretly film patients during intimate examinations. A colleague reported him to hospital administration in February 2013.
Johns Hopkins terminated Levy immediately. He died by suicide days later. Police then discovered approximately 1,200 images and videos of patients on his personal devices.
The lawsuit accused Johns Hopkins of knowing, or having reason to know, about Levy’s conduct and failing to stop it. Plaintiffs argued the institution prioritized its reputation over patient safety.
Key background facts:
- Levy worked at Johns Hopkins from 1988 to 2013
- He used a pen-shaped digital camera during exams
- He was discovered by a coworker, not through any hospital audit
- Johns Hopkins settled without admitting wrongdoing
The institution’s failure to detect this over 25 years was the crux of the negligence argument. That’s roughly the same amount of time it takes to build a medical career from scratch.
Dr. Nikita Levy and the Johns Hopkins Abuse Case
Dr. Nikita Levy is the central figure in the primary Johns Hopkins abuse lawsuit. He was a board-certified OB-GYN who patients trusted for routine and sensitive care.
Levy used a button-sized camera hidden on a pen-like device to record patients during pelvic examinations without their knowledge or consent. The recordings captured some of the most intimate moments a patient can experience in a medical setting.
After his death in February 2013, investigators found the recordings on his devices. The volume of material was staggering.
What investigators found:
- Approximately 1,200 images and videos
- Recordings spanned multiple years of Levy’s practice
- Patients were filmed without any awareness or consent
- Material was stored on personal devices, not hospital systems
Levy was never criminally prosecuted because he died before charges were filed. That left victims with only one path: civil litigation against Johns Hopkins as the institution that employed and supervised him.
The emotional harm to victims was significant. Many women described learning about the recordings as a second violation, occurring years after the physical exams themselves.
Johns Hopkins Lawsuit Settlement Amount
The Johns Hopkins lawsuit settled for $190 million in 2014. This was the largest settlement ever paid by a U.S. medical institution at the time it was reached.
Settlement at a glance:
| Detail | Amount / Info |
|---|---|
| Total Settlement Fund | $190 million |
| Year Settled | 2014 |
| Number of Claimants (Estimated) | Approximately 8,000 |
| Administering Court | U.S. District Court, District of Maryland |
| Johns Hopkins Admission of Fault | None |
The settlement came after plaintiffs’ attorneys, including Jonathan Schochor and Philip Federico, negotiated aggressively on behalf of thousands of women who came forward after news of Levy’s recordings broke publicly.
Johns Hopkins agreed to pay without admitting any liability. That is standard in large institutional settlements. The money went into a claims fund administered by a court-appointed settlement administrator.
The $190 million figure was historic. It signaled that even the most prestigious medical institutions are not above accountability when their employees harm patients.
Key Takeaway: The Johns Hopkins abuse settlement totaled $190 million, paid in 2014, covering roughly 8,000 victims of Dr. Nikita Levy’s hidden-camera recordings during gynecological exams.
Johns Hopkins $190 Million Settlement Breakdown
The $190 million fund was not distributed equally to all claimants. Payments were structured in tiers based on the nature and severity of the harm each victim experienced.
This is how most large abuse settlements work. Think of it like an insurance payout system: those with documented, severe harm received more; those with documented but less severe harm received less.
Tier structure (general framework used):
| Tier | Harm Level | Estimated Payout Range |
|---|---|---|
| Tier 1 | Confirmed recording with significant emotional distress documented | Highest payouts |
| Tier 2 | Patient of Levy during recording period, moderate documented harm | Mid-range payouts |
| Tier 3 | Patient of Levy, limited documentation of harm | Lower but still meaningful payouts |
Exact per-person payment amounts were not publicly disclosed in full. The settlement administrator evaluated individual claims based on submitted documentation, including medical records, therapy records, and sworn statements.
Attorney fees and administrative costs were deducted from the total $190 million before distribution to claimants.
The claims process was structured to be private to protect victim identities. That privacy protection was built into the settlement agreement.
Who Qualifies for the Johns Hopkins Lawsuit Settlement?
Qualification for the original $190 million settlement required being a patient of Dr. Nikita Levy during his employment at Johns Hopkins East Baltimore Medical Center.
The settlement claims period closed years ago. The original deadline for filing claims under the Levy abuse settlement has long passed for most claimants.
Original eligibility criteria (historical reference):
- Had a gynecological examination performed by Dr. Nikita Levy
- Was treated at Johns Hopkins East Baltimore Medical Center
- Was treated between approximately 1988 and 2013
- Filed a claim during the claims submission window
For the 2023 data breach lawsuit, eligibility is based on a different set of criteria entirely, covered in a later section of this article.
In 2026, the question most people are asking is not whether they qualified in 2014. They want to know if there are still active claims they can pursue. The answer depends on which lawsuit they are asking about.
Johns Hopkins Settlement Eligibility Requirements
The eligibility requirements for the Levy abuse settlement were specific and court-supervised. This was not a case where anyone who heard about it could file a claim.
Requirements that had to be met:
- Proof of being an actual patient of Dr. Levy at the specified facility
- Documentation of the patient-doctor relationship (medical records)
- Submission of a valid claim form within the court-approved window
- Agreement to release Johns Hopkins from further legal claims upon receiving payment
Claimants did not need to prove they were individually recorded. The settlement covered all patients who were examined by Levy during the relevant period, recognizing that not all recordings could be verified individually.
For the data breach case, the eligibility requirements are different:
- Must be among the ~310,000 individuals whose data was exposed in the 2023 MOVEit breach
- Must demonstrate that their information was part of the Johns Hopkins data sets compromised
- Must file within the applicable statute of limitations for their state
Key Takeaway: The Levy abuse settlement closed its claims window years ago. In 2026, new legal action related to Johns Hopkins centers primarily on the 2023 data breach affecting 310,000 individuals.
How Much Will I Get From the Johns Hopkins Lawsuit?
For the Levy abuse settlement, individual payments ranged widely based on documented harm and the tier in which a claim was placed. Reported figures from attorneys involved in the case suggested payments to some victims ranged from a few thousand dollars to over $75,000 for the most severely documented cases.
The average payment across all claimants was not publicly disclosed. Attorney fees of approximately 33% were standard, reducing the net amount each claimant received.
Estimated payout context:
| Claimant Category | Approximate Payment Range |
|---|---|
| Severe, well-documented harm | $50,000 to $75,000+ |
| Moderate harm with documentation | $10,000 to $50,000 |
| Lesser documented cases | $1,000 to $10,000 |
For the data breach claims, payouts are likely to be significantly smaller. Data breach settlements typically result in payments of $100 to $5,000 per claimant depending on documented out-of-pocket losses, time spent on remediation, and whether identity theft occurred.
The math is simple. Divide a settlement fund by thousands of claimants, subtract legal fees, and individual checks are often smaller than people expect.
Johns Hopkins Payout Per Person: What Victims Received
The individual payout figures from the Levy settlement were kept confidential as part of the settlement agreement. This protected victim privacy, which was a priority given the sensitive nature of the recordings.
What attorneys involved in the case confirmed publicly is that the claims were evaluated on a points-based system. Points were assigned based on factors like the number of documented exams with Levy, evidence of emotional distress, and therapy or counseling records submitted.
Factors that influenced individual payouts:
- Number of exams performed by Levy on that patient
- Whether the patient was confirmed to have been recorded
- Psychological harm documentation (therapy bills, mental health records)
- Length of time between the harm and the claim filing
- Attorney representation versus pro se filing
Victims who worked with experienced attorneys generally received higher evaluations than those who filed on their own. Legal representation made a measurable difference in this case.
For the data breach, per-person payouts will follow a similar tiered approach, weighted by documented actual losses from the exposure of personal data.
How to File a Johns Hopkins Lawsuit Claim in 2026
Filing a claim for the original Levy abuse settlement is no longer possible. That claims window closed. In 2026, the active filing opportunities are connected to the Johns Hopkins data breach litigation.
If your data was exposed in the 2023 Johns Hopkins data breach, here is the current process:
Steps to file a data breach claim in 2026:
- Confirm you received a breach notification letter from Johns Hopkins
- Gather documentation of any losses (identity theft costs, credit monitoring fees, time spent)
- Check for any active class action suits related to the MOVEit breach involving Johns Hopkins
- Contact a mass tort or data breach attorney for a free case evaluation
- Submit your claim through the official claims process if a settlement is reached
Be cautious of third-party claim filing services that charge fees upfront. Legitimate class action claims are free to file. Attorneys take fees only from settlements.
Key Takeaway: In 2026, the only active claim-filing opportunity connected to Johns Hopkins involves the 2023 data breach, not the original Levy abuse case. The Levy settlement claims period closed years ago.
Johns Hopkins Claim Deadline 2026
Deadlines are the most critical detail in any lawsuit. Missing one means losing your right to compensation, full stop.
For the Levy abuse settlement, all claim deadlines have passed. The settlement was finalized and funds distributed years ago. There is no mechanism to reopen those claims in 2026.
For the data breach lawsuit, deadlines depend on:
- The statute of limitations in your state for data breach claims (typically 2 to 3 years from discovery)
- Any class action tolling agreements that may extend individual deadlines
- The specific court order governing any active Johns Hopkins data breach settlement
Since the breach was disclosed in June 2023, the statute of limitations clock started for most potential claimants in mid-2023.
| Case | Deadline Status |
|---|---|
| Levy Abuse Settlement | Closed. No new claims possible. |
| 2023 Data Breach Claims | Active. Check individual state deadlines. |
| Other Johns Hopkins Claims | Case-specific. Attorney evaluation needed. |
If you think you have a claim, acting in 2026 is urgent. Waiting until 2027 could place you outside the statute of limitations for data breach claims.
Johns Hopkins Lawsuit Timeline and Key Dates
Understanding the full history of this case helps explain where things stand in 2026.
Complete timeline:
| Year | Event |
|---|---|
| 1988 | Dr. Nikita Levy begins working at Johns Hopkins East Baltimore Medical Center |
| 2013 (Feb) | Coworker reports Levy to hospital administration |
| 2013 (Feb) | Levy is terminated; dies by suicide days later |
| 2013 (Feb-Mar) | Police discover ~1,200 recordings on Levy’s devices |
| 2013 | Class action lawsuit filed in U.S. District Court, District of Maryland |
| 2014 | $190 million settlement reached and court-approved |
| 2014-2015 | Claims period opens; approximately 8,000 victims file claims |
| 2016-2018 | Settlement distributions made to claimants |
| 2023 (June) | Johns Hopkins announces MOVEit data breach; ~310,000 records exposed |
| 2023-2024 | Data breach class action lawsuits filed |
| 2026 | Data breach litigation ongoing; Levy claims fully closed |
This timeline makes clear that these are two separate legal events separated by nearly a decade. They share one common thread: Johns Hopkins failed the people who trusted it.
Johns Hopkins Data Breach Lawsuit Update 2026
The Johns Hopkins data breach is a completely separate legal matter from the Levy abuse case. It requires its own explanation.
In June 2023, Johns Hopkins University and Johns Hopkins Health System disclosed that a cybersecurity incident had compromised the personal data of approximately 310,000 individuals. The breach was tied to the MOVEit file transfer software, which was exploited globally by the Cl0p ransomware group.
The exposed data included names, contact information, dates of birth, Social Security numbers, and health billing information.
Data breach key facts:
| Detail | Information |
|---|---|
| Breach Disclosed | June 2023 |
| Records Affected | Approximately 310,000 |
| Data Exposed | Names, SSNs, DOBs, health billing data |
| Attack Vector | MOVEit software vulnerability |
| Threat Actor | Cl0p ransomware group |
| Lawsuit Status (2026) | Active litigation; settlement TBD |
Multiple class action lawsuits were filed against Johns Hopkins following the disclosure. In 2026, those cases are either in active litigation, mediation, or early settlement discussion stages.
Key Takeaway: The Johns Hopkins data breach affected 310,000 people in 2023. Separate from the Levy abuse case, this breach has spawned its own class action litigation, which remains active in 2026.
Johns Hopkins Institutional Negligence: The Broader Picture
The Levy case and the data breach are related by a common theme: institutional failure at a prestigious organization that knew better.
In the Levy case, the question was how a physician could secretly record patients for years without detection. Plaintiffs argued Johns Hopkins ignored warning signs, failed to conduct proper supervision, and prioritized its own reputation over patient welfare.
In the data breach case, the question is why a major health system used software with a known vulnerability and failed to protect sensitive patient data.
These cases fit a broader pattern in American institutional liability law. Large hospitals and universities are increasingly being held to account not just for what employees do, but for what the institution failed to prevent.
Patterns in institutional negligence claims:
- Failure to supervise employees with patient access
- Failure to implement cybersecurity protections for sensitive data
- Delayed response after discovering problems
- Institutional prioritization of reputation over victim notification
- Settlement without admission of liability as standard resolution
Johns Hopkins is not unique in facing this type of litigation. What makes these cases notable is the scale of harm and the settlement amounts involved.
Johns Hopkins Lawsuit Case Status in 2026
In 2026, here is the straightforward status of both major Johns Hopkins legal matters:
Levy Abuse Case:
Fully resolved. The $190 million settlement was paid and distributed. No new claims are being accepted. The case is closed from a civil litigation standpoint.
Data Breach Case:
Active. Class action lawsuits filed in response to the June 2023 MOVEit breach are in various stages of litigation or negotiation in 2026. No final settlement has been publicly announced at this time. Affected individuals may still have legal options.
Other Johns Hopkins Claims:
Johns Hopkins, like any major hospital system, faces ongoing litigation on various individual negligence and malpractice claims. These are separate from the two cases covered in this article.
| Lawsuit | 2026 Status | Action Available? |
|---|---|---|
| Levy Abuse Settlement | Fully Closed | No |
| 2023 Data Breach | Active Litigation | Yes, consult attorney |
| Other Malpractice Claims | Ongoing Case-by-Case | Yes, case-specific |
The most actionable situation for people reading this in 2026 is the data breach case. If your data was exposed, legal options may still be open.
What Happens If You Missed the Johns Hopkins Settlement Deadline?
Missing the claims deadline for the Levy abuse settlement means you cannot participate in that settlement fund. The $190 million has been distributed. Courts do not typically reopen closed settlement funds.
There are a small number of exceptions worth knowing:
- If you were legally incapacitated during the claims period (in a coma, a minor without a guardian, etc.), courts may allow late claims in rare circumstances.
- If your attorney failed to file your claim properly and committed legal malpractice, you may have a claim against your attorney rather than against Johns Hopkins.
- If you were not notified of the settlement despite being a class member and can prove this, some courts allow late-filer petitions.
These exceptions are narrow. Most people who missed the Levy deadline have no remaining legal path against Johns Hopkins for those specific claims.
Options if you missed the Levy settlement deadline:
- Consult an attorney about whether any exception applies
- Investigate whether a separate malpractice claim (outside the class action) is still within your state’s statute of limitations
- Check if you are eligible for the unrelated data breach claims process
Key Takeaway: Missing the Levy settlement deadline is almost always permanent. The only realistic 2026 options involve the data breach lawsuit or individual state-law claims that have not yet expired.
Frequently Asked Questions
How much money will I get from the Johns Hopkins lawsuit settlement?
If you are asking about the Levy abuse settlement, that fund has been fully distributed and is closed.
Individual payments in the Levy case ranged from a few thousand dollars to over $75,000 depending on documented harm.
For the ongoing 2023 data breach claims, any eventual payout would be determined by the settlement terms negotiated in that separate case.
Who qualifies for the Johns Hopkins abuse settlement?
The Johns Hopkins abuse settlement required being a patient of Dr. Nikita Levy at Johns Hopkins East Baltimore Medical Center between 1988 and 2013.
The claims window for that settlement closed years ago.
If you did not file a claim during that period, you are no longer eligible for that specific settlement fund.
Is the Johns Hopkins lawsuit still open in 2026?
The original Levy abuse lawsuit settlement is fully closed as of 2026.
The Johns Hopkins data breach lawsuit, filed following the June 2023 MOVEit hack, remains active and is the only open legal matter connected to Johns Hopkins with potential claim opportunities in 2026.
Contact a data breach attorney if you were notified that your information was exposed.
What was the Johns Hopkins data breach lawsuit about?
The Johns Hopkins data breach lawsuit involves the exposure of personal and medical billing data belonging to approximately 310,000 individuals in June 2023.
The breach was caused by a vulnerability in the MOVEit file transfer software exploited by the Cl0p ransomware group.
Class action lawsuits seek compensation for affected individuals whose Social Security numbers, dates of birth, and health billing information were exposed.
Can I still file a claim if I missed the original Johns Hopkins deadline?
For the Levy abuse settlement, the answer is almost certainly no.
Courts rarely reopen closed settlement funds, and the $190 million has already been distributed to claimants.
Your best path in 2026 is to speak with a mass tort attorney about the data breach case or any individual state-law claims that may still fall within your state’s statute of limitations.
The Final Word on the Johns Hopkins Lawsuit in 2026
The Johns Hopkins lawsuit story is really two stories. One is about a physician who betrayed thousands of patients over 25 years, and the institution that failed to catch him. The other is about a data breach that put 310,000 people’s most sensitive information at risk.
If you were a patient of Dr. Levy and missed the original claims window, your options are limited but worth exploring with an attorney. If your data was exposed in the 2023 breach, you may still have active legal rights.
Do not sit on potential claims. Deadlines exist for a reason, and 2026 is a critical year for data breach claims from the 2023 incident. Check your records, verify whether you received a breach notification letter, and get a professional evaluation.
