Legal News about HIPAA and Healthcare Compliance

LivaNova Facing Multiple Class Action Lawsuits Over October 2023 Cyberattack

Posted by Steve Alder

The Houston, TX-based medical device company, LivaNova, is facing multiple class action lawsuits over an October 2023 cyberattack that exposed the protected health information of 180,000 patients.

The attack was detected on November 19, 2023, and the investigation confirmed that unauthorized individuals first accessed its network on October 26, 2023. The data compromised in the incident included names, addresses, phone numbers, Social Security numbers, birth dates, diagnoses, treatment information, prescriptions, physician names, medical record numbers, device serial numbers, and health insurance information. Notifications were issued in May 2024, and complimentary credit monitoring services were offered to the affected individuals.

At least two lawsuits have now been filed by patients whose information was exposed in the incident. One of those lawsuits was filed in the U.S. District Court for the Southern District of Texas, Houston Division, on behalf of J.W., by and through her guardian, Angela Johnson. The lawsuit alleges LivaNova maintained sensitive information in a reckless manner and despite its legal obligations and promises to secure the data it held, failed to implement reasonable and appropriate cybersecurity measures. The lawsuit alleges the cyberattack and data breach were foreseeable and preventable, and occurred as a result of inadequate cybersecurity measures.

The lawsuit also accuses the defendant of failing to issue prompt and accurate breach notifications to the affected individuals. The notification letters were sent 6 months after the security breach was detected and 7 months after it occurred. The lawsuit alleges the plaintiff and class members face an ongoing risk of fraud, identity theft, and other misuses of their sensitive information as a result of the data breach.

The lawsuit alleges negligence, negligence per se, breach of implied contract, breach of fiduciary duty, unjust enrichment, and a violation of the Illinois Consumer Fraud Act and seeks damages, injunctive relief, an award of attorneys’ fees, court costs, and litigation costs, and equitable relief, including an order from the court compelling LivaNove to implement a long list of security measures to prevent similar breaches in the future. The plaintiff and class are represented by Joe Kendall of Kendall Law Group PLLC and Mariya Weekes of Millberg, Coleman, Bryson, Phillips, Grossman PLLC.

Another lawsuit was filed by plaintiff Arthur Podroykin in the U.S. District Court for the Southern District of Texas that alleges LivaNova breached its duties under common law, contract, the Federal Trade Commission Act, and the Health Insurance Portability and Accountability Act.

The post LivaNova Facing Multiple Class Action Lawsuits Over October 2023 Cyberattack appeared first on The HIPAA Journal.

Pennsylvania’s Updated Breach Notification Law Requires Credit Monitoring Services for Breach Victims

Posted by Steve Alder

Pennsylvania has updated its data breach notification law, narrowing the definition of personal information, adding the requirement to notify the state Attorney General, and requiring credit monitoring services to be provided to data breach victims in certain circumstances. The Breach of Personal Information Notification Act was amended by Senate Bill 824 and was signed into law by state Governor Josh Shapiro on June 28, 2024. The amended law takes effect on September 26, 2024.

The law requires organizations that maintain computerized data that includes personal information to issue notifications to the affected individuals in the event of a breach of their unencrypted and unredacted personal information, or if personal information is reasonably believed to have been accessed or obtained by an unauthorized individual. Notifications must be sent without unreasonable delay, but there is no fixed time frame for issuing those notifications unless the breach occurs at a Pennsylvania state agency or state agency contractor, in which case the notifications must be issued within 7 days of the determination of a data breach.

Personal information is defined as an individual’s name combined with any of the following: Social Security number, driver’s license number, state identification card number, financial account /credit card/debit card number along with information that would allow the account to be accessed, medical information, health insurance information, or a username/email address and password combination that would allow the online account to be accessed. The amendment changes the term “medical information” to “medical information in the possession of a state agency or state agency contractor.”

In addition to issuing individual notifications, entities are now required to notify the Pennsylvania Attorney General at the same time that individual notifications are sent if the breach requires notification to more than 500 individuals in the Commonwealth, with exemptions for certain insurance companies. The Attorney General should be informed about the date of the breach, the known or estimated number of affected individuals, the known or estimated number of affected Pennsylvania residents, and a summary of the breach incident.

Previously, entities that suffered a breach subject to the Breach of Personal Information Notification Act were required to notify consumer reporting agencies about the breach if it affected more than 1,000 individuals. The threshold for notification has now been reduced to 500 individuals. The most important change for Pennsylvania residents is the legal requirement for a breached entity to provide credit monitoring services for 12 months, under certain circumstances.

Credit monitoring services must be provided if a consumer reporting agency is required to be notified by law and if the breach involved an individual’s Social Security number, bank account number, driver’s license number, or state identification number. The services must include access to an independent credit report from a consumer reporting agency if the individual is not eligible to obtain a free credit report and access to credit monitoring services for 12 months from the date of notification. If the individual is eligible to receive those services free of charge for 12 months, it is an acceptable alternative to advise them of the availability of those free services.

The post Pennsylvania’s Updated Breach Notification Law Requires Credit Monitoring Services for Breach Victims appeared first on The HIPAA Journal.

Seattle Plastic Surgery Practice to Pay $5 Million to Resolve False Review and Illegal NDA Lawsuit

Posted by Steve Alder

A Seattle, WA, plastic surgery practice has been ordered to pay a financial penalty of $5 million to the Office of the Washington Attorney General to resolve alleged violations of the Health Insurance Portability and Accountability Act (HIPAA), Washington Consumer Protection Act (CPA), and the federal Consumer Review Fairness Act (CRFA).

Dr. Javad Sajan, the owner of Allure Esthetic, has offices in Washington and other states and provides surgical and non-surgical plastic and cosmetic surgery procedures operating as Allure Esthetic, Gallery of Cosmetic Surgery, Seattle Plastic Surgery, Alderwood Surgical Center, Northwest Nasal Sinus Center, and Northwest Face and Body.

Washington Attorney General, Bob Ferguson, filed a lawsuit against Allure Esthetic and Dr. Sajan alleging the practice falsified online reviews to inflate the plastic surgeon’s reputation. According to the lawsuit, between 2017 and 2019, Dr. Sajan forced patients to sign illegal non-disclosure agreements that prohibited them from posting any negative online comments about Allure Esthetic. Those non-disclosure agreements were only provided after a $100 non-refundable consultation fee was paid. The non-disclosure agreements also required some patients to waive their HIPAA rights to allow the practice to respond to negative reviews using their personal health information.

Patients who were unhappy with their treatment and posted negative reviews were offered money and free services if they agreed to take down their reviews, and were threatened with fines if they posted negative reviews in the future. Some patients were sued when they refused to take down their truthful reviews. Dr. Sajan was also accused of instructing employees to set up fake email accounts posing as patients to post fake, positive reviews on sites such as Yelp and Google, and altering before and after photographs before they were added to the company’s social media accounts. Dr. Sajan was also accused of rigging “best doctor” competitions hosted by local media outlets, and applying for and retaining tens of thousands of dollars in rebates that should have been provided to patients.

In April 2024, a federal judge ruled that Allure’s non-disclosure agreements violated the Consumer Review Fairness Act (CRFA), which protects consumers’ rights to post truthful reviews about a business, and that Allure Esthetic’s practices violated HIPAA and the CPA. The consent decree issued by the U.S. District Court for the Western District of Washington requires Allure to pay $1.5 million in restitution to around 21,000 Washington residents. Each of those individuals will receive a check for $50 or $120, based on their circumstances. If they were forced to sign a non-disclosure agreement they will receive $50, and if they paid the non-refundable fee, they will receive $120 as a refund of the fee plus interest.

Allure is required to notify all individuals by mail that they will be receiving a check as a result of the Attorney General’s lawsuit and that they have been freed from the terms of their illegal NDAs. Allure must also send them their checks along with a letter from the Attorney General’s Office. The remaining $3.5 million of the settlement will go to the Attorney General’s Office to cover attorneys’ fees, investigation and prosecution costs, future monitoring, and enforcement of the decree and Washington’s consumer protection laws.

Allure is also required to conduct an audit of all review sites and request the removal of any review that Allure was involved in creating, posting, or shaping, and must remove any misleading photographs from its social media platforms. Allure is prohibited from altering future before and after photographs and using and attempting to enforce illegal non-disclosure agreements. Allure must also pay for a third-party forensic accounting company to conduct a full audit of its consumer rebate program to identify all consumers owed rebates that were illegally claimed by Allure.

“Writing a truthful review about a business should not subject you to threats or intimidation,” said AG Ferguson. “Consumers rely on reviews when determining who to trust, especially services that affect their health and safety. This resolution holds Allure accountable for brazenly violating that trust — and the law — and ensures the clinic stops its harmful conduct. We will take action against any business that attempts to silence and intimidate honest Washingtonians.”

The post Seattle Plastic Surgery Practice to Pay $5 Million to Resolve False Review and Illegal NDA Lawsuit appeared first on The HIPAA Journal.

Seattle Plastic Surgery Practice to Pay $5 Million to Resolve False Review and Illegal NDA Lawsuit

Posted by Steve Alder

A Seattle, WA, plastic surgery practice has been ordered to pay a financial penalty of $5 million to the Office of the Washington Attorney General to resolve alleged violations of the Health Insurance Portability and Accountability Act (HIPAA), Washington Consumer Protection Act (CPA), and the federal Consumer Review Fairness Act (CRFA).

Dr. Javad Sajan, the owner of Allure Esthetic, has offices in Washington and other states and provides surgical and non-surgical plastic and cosmetic surgery procedures operating as Allure Esthetic, Gallery of Cosmetic Surgery, Seattle Plastic Surgery, Alderwood Surgical Center, Northwest Nasal Sinus Center, and Northwest Face and Body.

Washington Attorney General, Bob Ferguson, filed a lawsuit against Allure Esthetic and Dr. Sajan alleging the practice falsified online reviews to inflate the plastic surgeon’s reputation. According to the lawsuit, between 2017 and 2019, Dr. Sajan forced patients to sign illegal non-disclosure agreements that prohibited them from posting any negative online comments about Allure Esthetic. Those non-disclosure agreements were only provided after a $100 non-refundable consultation fee was paid. The non-disclosure agreements also required some patients to waive their HIPAA rights to allow the practice to respond to negative reviews using their personal health information.

Patients who were unhappy with their treatment and posted negative reviews were offered money and free services if they agreed to take down their reviews, and were threatened with fines if they posted negative reviews in the future. Some patients were sued when they refused to take down their truthful reviews. Dr. Sajan was also accused of instructing employees to set up fake email accounts posing as patients to post fake, positive reviews on sites such as Yelp and Google, and altering before and after photographs before they were added to the company’s social media accounts. Dr. Sajan was also accused of rigging “best doctor” competitions hosted by local media outlets, and applying for and retaining tens of thousands of dollars in rebates that should have been provided to patients.

In April 2024, a federal judge ruled that Allure’s non-disclosure agreements violated the Consumer Review Fairness Act (CRFA), which protects consumers’ rights to post truthful reviews about a business, and that Allure Esthetic’s practices violated HIPAA and the CPA. The consent decree issued by the U.S. District Court for the Western District of Washington requires Allure to pay $1.5 million in restitution to around 21,000 Washington residents. Each of those individuals will receive a check for $50 or $120, based on their circumstances. If they were forced to sign a non-disclosure agreement they will receive $50, and if they paid the non-refundable fee, they will receive $120 as a refund of the fee plus interest.

Allure is required to notify all individuals by mail that they will be receiving a check as a result of the Attorney General’s lawsuit and that they have been freed from the terms of their illegal NDAs. Allure must also send them their checks along with a letter from the Attorney General’s Office. The remaining $3.5 million of the settlement will go to the Attorney General’s Office to cover attorneys’ fees, investigation and prosecution costs, future monitoring, and enforcement of the decree and Washington’s consumer protection laws.

Allure is also required to conduct an audit of all review sites and request the removal of any review that Allure was involved in creating, posting, or shaping, and must remove any misleading photographs from its social media platforms. Allure is prohibited from altering future before and after photographs and using and attempting to enforce illegal non-disclosure agreements. Allure must also pay for a third-party forensic accounting company to conduct a full audit of its consumer rebate program to identify all consumers owed rebates that were illegally claimed by Allure.

“Writing a truthful review about a business should not subject you to threats or intimidation,” said AG Ferguson. “Consumers rely on reviews when determining who to trust, especially services that affect their health and safety. This resolution holds Allure accountable for brazenly violating that trust — and the law — and ensures the clinic stops its harmful conduct. We will take action against any business that attempts to silence and intimidate honest Washingtonians.”

The post Seattle Plastic Surgery Practice to Pay $5 Million to Resolve False Review and Illegal NDA Lawsuit appeared first on The HIPAA Journal.

Heritage Valley Health System Pays $950,000 to Settle Alleged HIPAA Security Rule Violations

Posted by Steve Alder

The HHS’ Office for Civil Rights (OCR) has agreed to settle alleged HIPAA Security Rule violations with Heritage Valley Health System for $950,000. Heritage Valley is a 3-hospital health system with more than 50 physician offices and many community satellite facilities in Pennsylvania, eastern Ohio, and the panhandle of West Virginia.

In 2017, Heritage Valley was affected by a global malware attack that saw NotPetya malware installed on its network via a connection with its business associate, Nuance Communications. OCR launched an investigation of Heritage Valley in October 2017 following media reports of a data security incident to determine whether Heritage Valley was compliant with the requirements of the HIPAA Security Rule.

OCR’s investigation uncovered multiple Security Rule compliance failures, including the most commonly identified Security Rule issue – The failure to conduct an accurate and thorough risk analysis to identify potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI), as required by 45 C.F.R. § 164.308(a)(1)(ii)(A).

The HIPAA Security Rule – 45 C.F.R. § 164.308(a)(7) – requires covered entities to develop and implement a contingency plan for responding to an emergency that damages systems containing ePHI. Heritage Valley was found not to be compliant with this requirement. OCR also identified a failure to implement technical policies and procedures for electronic information systems that maintain ePHI only to permit access by authorized persons or software programs – 45 C.F.R. § 164.308(a)(4) and 164.312(a)(1)).

The healthcare industry is being targeted by ransomware groups and ransomware-related data breaches have increased by 264% since 2018. Healthcare organizations that are fully compliant with the HIPAA Security Rule can reduce the risk of a ransomware attack succeeding and can limit the harm caused in the event of a successful attack.

In addition to paying the financial penalty, Heritage Valley has agreed to implement a corrective action plan, compliance with which will be monitored by OCR for 3 years. The corrective action plan includes the requirement to conduct an accurate and thorough risk analysis, implement a risk management plan to reduce identified risks and vulnerabilities and review, develop, maintain, and revise as necessary its written policies and procedures to comply with the HIPAA Rules and provide training to the workforce on those policies and procedures.

“Hacking and ransomware are the most common type of cyberattacks within the health care sector. Failure to implement the HIPAA Security Rule requirements leaves health care entities vulnerable and makes them attractive targets to cyber criminals,” said OCR Director Melanie Fontes Rainer. “Safeguarding patient-protected health information protects privacy and ensures continuity of care, which is our top priority. We remind and urge health care entities to protect their records systems and patients from cyberattacks.”

This is the third OCR HIPAA penalty imposed in response to a ransomware attack and the fifth HIPAA enforcement action of 2024 to result in a financial penalty.

Total HIPAA enforcement funds paid to OCR

When announcing the enforcement action, OCR took the opportunity to remind all HIPAA-regulated entities of their responsibilities under the HIPAA Security Rule to take action to mitigate or prevent cyber threats. These include:

  • Reviewing relationships with business associates, ensuring a business associate agreement is in place, and addressing data breach and security incident obligations
  • Integrating risk analysis and risk management into business processes, and conducting risk analyses when new technologies are implemented and business operations change.
  • Ensuring an audit trail is maintained and information system activity is regularly reviewed
  • Encrypting ePHI to prevent unauthorized access and implementing multifactor authentication on accounts
  • Providing regular training to the workforce specific to the organization and job responsibilities and reinforcing the role of members of the workforce with respect to privacy and security
  • When security incidents occur, incorporate the lessons learned into the security management process.

The post Heritage Valley Health System Pays $950,000 to Settle Alleged HIPAA Security Rule Violations appeared first on The HIPAA Journal.

Iowa Doctor Pleads Guilty to HIPAA Violations

Posted by Steve Alder

An Iowa emergency room doctor has pleaded guilty to violating HIPAA by knowingly accessing the medical records of two patients without authorization when there was no treatment relationship with the patients. Dr. Gabriel Alejandro Hernandez Roman, 30, was a resident at two University of Iowa hospitals between 2020 and 2023, one in Cedar Rapids and another in Iowa City. During that time, Hernandez Roman knowingly and without authorization obtained the medical records of two individuals without their knowledge or consent. The two individuals did not have a treatment relationship with Hernandez Roman and were former romantic partners.

University of Iowa Hospitals and Clinics (UIHC) launched an investigation in early 2023 into the alleged privacy violations, confirmed that the patient records had been accessed, and questioned Hernandez Roman about why he had accessed the medical records.  Hernandez Roman confirmed he was in a relationship with the first woman and said he accessed her records because he was concerned that she was having a psychotic breakdown. He also admitted to accessing the records of another former partner to check lab results for any sexually transmitted infections.

In another incident in January 2022, Hernandez Roman took a photograph of a patient’s prolapsed rectum when there was no legitimate medical reason for taking the photo and sent it via Snapchat to a woman he was dating at the time along with an unprofessional commentary. Hernandez Roman lied to the investigator about the reason for sharing the photo, which he claimed was sent to his mother to remind her of the importance of fiber intake. Following the investigation, Hernandez Roman’s Emergency Medicine Residency was terminated.

Hernandez Roman was also investigated by the Iowa Board of Medicine over his performance and privacy violations. The Board of Medicine investigation revealed Hernandez Roman’s performance fell below what was expected, his recordkeeping was poor, and concerns had been raised about the amount of time he spent on his phone. Numerous patients had requested they be treated by a different physician, and complaints had been made by nurses about his lack of professionalism with staff, patients, and patients’ families. The board also learned that he had been moonlighting at a hospital in Ottumwa when he had not received authorization from UIHC and had not completed the required coursework.

Hernandez Roman blamed his unprofessional behavior on poor mental health and cultural and language barriers; however, those arguments were rejected by the Board of Medicine which found the justification he provided for accessing the private health information of women he had a sexual/romantic relationship with was blatantly untruthful and he had a history of dishonesty. In February 2024, the Board of Medicine issued an emergency order suspending his license indefinitely due to unprofessional conduct and alleged incompetence and imposed a $7,500 financial penalty. Before the suspension can be lifted, the Board of Medicine requires Dr. Hernandez Roman to complete a comprehensive psychological evaluation, complete any recommended treatment, and provide proof of completion of a board-approved course on ethics, professional boundaries, recordkeeping, and patient privacy.

Hernandez Roman was also charged with criminal HIPAA violations. Under the plea agreement, he pled guilty to one count of wrongfully obtaining individually identifiable health information relating to an individual under false pretenses and faces a jail term of up to 5 years, three years of supervised release, and a fine of up to $250,000.

The post Iowa Doctor Pleads Guilty to HIPAA Violations appeared first on The HIPAA Journal.

BioPlus Specialty Pharmacy Services Proposes Settlement to Resolve Data Breach Lawsuit

Posted by Steve Alder

BioPlus Specialty Pharmacy Services has proposed a settlement to resolve a class action lawsuit that was filed in response to a 2021 data breach that exposed the data of up to 350,000 patients. Hackers gained access to the BioPlus network for more than 2 weeks between October and November 2021, and potentially stole names, dates of birth, contact information, health insurance information, prescription information, and Social Security numbers. The Florida specialty pharmacy chain notified the affected individuals within a month and offered them complimentary credit monitoring services.

A lawsuit was filed over the data breach alleging BioPlus should have prevented the breach and could have if reasonable cybersecurity measures had been implemented and industry-standard security best practices had been followed. BioPlus disagreed with the allegations; however, a settlement has been proposed to bring the legal action to an end. BioPlus has not admitted liability or any wrongdoing related to the cyberattack and data breach.

Under the terms of the proposed settlement, class members may submit claims of up to $7,550 and will be reimbursed for out-of-pocket expenses incurred as a result of the data breach. The maximum claim permitted depends on whether Social Security numbers were compromised. If they were, class members can claim a cash payment of $50 and can claim up to $7,500 for documented expenses incurred as a result of the data breach, including 3 hours of lost time at $25 per hour, and any unreimbursed losses to identity theft and fraud.

Class members whose Social Security numbers were not breached cannot claim a cash payment and claims will be limited to a maximum of $750, including 2 hours of lost time at $25 per hour. Any individual who wishes to object to or be excluded from the settlement must do so by June 18, 2024, and all claims must be submitted by the same date. The settlement has received preliminary approval from the court and the final settlement hearing is scheduled for August 22, 2024. The plaintiff and class were represented by attorneys at Morgan & Morgan and Markovits, Stock, & DeMarco LLC.

The post BioPlus Specialty Pharmacy Services Proposes Settlement to Resolve Data Breach Lawsuit appeared first on HIPAA Journal.

BakerHostetler Report Identifies Healthcare Data Breach and Litigation Trends

Posted by Steve Alder

BakerHostetler has released the 10th edition of its Data Security Incident Response Report, which shares data from the incidents the law firm has helped to manage. The report provides insights into the current cyber threat landscape and litigation trends.

Data Breach Insights

Healthcare accounted for 28% of data breach incidents, followed by finance and insurance (17%), business and professional services (15%), and education (13%). The biggest known root cause of all incidents was the exploitation of unpatched vulnerabilities (23% of incidents) followed by phishing (20%). By far the most common cause of security incidents in 2023 was network intrusions, which accounted for 51% of security incidents the law firm helped to manage, followed by business email compromise incidents (26%), and inadvertent disclosures (26%).

Cybercriminals are getting better at covering their tracks, as the root cause of 36% of network intrusions could not be determined. The main known cause of these incidents was vulnerability exploitation (25% of attacks). Phishing was involved in 9% of network intrusions, 5% involved brute force or credential stuffing, 4% were due to misconfigurations, 3% were due to RDP compromise, and 3% due to social engineering. 72% of successful network intrusions involved the deployment of ransomware, 57% involved data exfiltration, and 46% saw malware installed.

The average ransom demand was $2,644,647 and the average ransom payment was $747,651 but these were considerably higher in healthcare with an average demand of $3,492,434 and an average ransom payment of $857,933. In healthcare, it took an average of 13.4 days to acceptable data restoration and an average of 158,362 notifications had to be sent. As has been seen in other data, the percentage of victims paying a ransom is falling. 27% of attacked companies paid a ransom in 2023, compared to 40% in 2022.

The was a significant increase in data breaches at vendors. In 2023, business associates were responsible for 60% of the breaches of 500 or more records that were reported to the HHS’ Office for Civil Rights (OCR), compared to 35% in 2022. There was also a major increase in the size of healthcare data breaches, jumping by almost 200% from 2022 to 2023, from 56.9 million individuals to 144.5 million in 2023. The median time from incident to discovery was 2 days, 0 days to containment, 33 days to complete the forensic investigation, and 60 days from discovery to notification. The average time from occurrence to detection was 42 days and from detection to notice was 75 days.

Phishing and social engineering attacks have been getting more sophisticated. New social engineering scams that have become common involve threat actors contacting IT helpdesks to request password resets and enroll new devices to accept MFA codes. Several business email compromise attacks occurred as a result of QR code phishing attacks (Quishing), and many phishing attacks occurred via SMS messages (smishing). While multifactor authentication was sufficient to keep threat actors out of email accounts, MFA is increasingly bypassed in attacks. 43% of incidents required notifications to be issued, with an average of 98,504 notifications required. Out of the 493 incidents that required notifications to be issued, 58% resulted in lawsuits being filed, up from 42 in 2022.

Class Action Lawsuits Over Tracking Technologies Soar

Class action lawsuits over website tracking technology breaches are increasingly being filed, especially against healthcare organizations following guidance from the HHS’ Office for Civil Rights warning that the technologies violated HIPAA. The Federal Trade Commission (FTC) is also cracking down on organizations that use the technology without informing consumers.

BakerHostetler is currently defending more than 300 privacy or data security lawsuits and over 100 of those lawsuits involve data breaches due to the use of tracking technologies. More than 200 lawsuits have now been filed against healthcare organizations as a result of the use of tracking technologies, 75% of which were filed in the past year. Many of these lawsuits are still in the early stages, with only one case so far granted class certification and one that has had class certification denied. The first trial in a healthcare website tracking technology lawsuit is due to take place this summer. Several lawsuits have been quickly settled, with each individual due to receive an average of between $4 and $5. Since those settlements have been announced there has been an increase in the initial demands for damages.

OCR Enforcement Insights

After three years of relatively high numbers of enforcement actions, 2023 saw a fall in OCR enforcement activity. In 2023 there was a notable reduction in enforcement actions over HIPAA Right of Access violations (4) than the average of 14 over the previous three years. While there was an increase in enforcement actions for other HIPAA violations – 10 in 2023 vs 5 in 2022 and 3 in 2021 – OCR only imposed 11 penalties in 2023 to resolve HIPAA violations, compared to an average of 19 in the three previous years. BakerHostetler suggests the drop off in enforcement actions may be due to OCR focusing on another enforcement priority. OCR has issued guidance on HIPAA compliance with respect to website tracking technologies, and BakerHostelter suggests that may now be an enforcement focus for OCR.

The post BakerHostetler Report Identifies Healthcare Data Breach and Litigation Trends appeared first on HIPAA Journal.

Federal Judge Tosses CommonSpirit Health Data Breach Lawsuit Due to Lack of Standing

Posted by Steve Alder

A federal court judge has recommended a class action lawsuit against CommonSpririt Health over its 2022 data breach should be dismissed due to the failure of the plaintiff to demonstrate that they had been harmed by the data breach.

CommonSpirit Health suffered a ransomware attack on October 2, 2022, that affected more than 100 CommonSpirit Health facilities across the United States. A threat actor gained access to its systems on September 16, 2022, and had access to those systems until October 3, 2022. The forensic investigation and document review confirmed that the protected health information of more than 623,000 patients had been exposed. The exposed data included full names, addresses, healthcare providers, medical record numbers, treatment/prescription information, dates of medical services, other health insurance information, and patient’s facility/account numbers.

Multiple class action lawsuits were filed against CommonSpririt Health over the cyberattack and data breach which made similar claims. The lawsuits alleged CommonSpirit Health was negligent due to the failure to implement reasonable and appropriate safeguards to ensure the privacy of the protected health information it held and delayed issuing breach notifications, which were not sent until April 5, 2023.

One of those lawsuits, Bonnie Maser v. CommonSpirit Health, alleged that the plaintiff suffered injuries as a result of the breach, including more than $3,000 in bank account fraud that led to the closure of her account. As a result of the fraud, the plaintiff could not afford to pay her rent, lost her housing, her credit score dropped 60 points, and she claimed to continue to suffer harm, including panic attacks caused by the stress of the data breach. Maser’s lawsuit alleged negligence, breach of implied contract, breach of the implied covenant of good faith and fair dealing, and unjust enrichment.

CommonSpirit Health argued that the plaintiff failed to allege a concrete or imminent harm to support Article III standing, failed to adequately allege the minimum amount in controversy under the Class Action Fairness Act, and failed to state a claim upon which relief could be granted. U.S. Magistrate Judge Suan Prose recommended that the lawsuit be dismissed due to a lack of Article III standing, as the plaintiff failed to demonstrate that the fraudulent charges were fairly traceable to the data breach.

This was the second such lawsuit against CommonSpirit Health to be tossed due to a lack of standing.  Two lawsuits against CommonSpirit Health that were filed in Illinois and were consolidated into a single lawsuit – Jose Antonio Koch individually and on behalf of his two minor children, and another by Leeroy Perkins – was also dismissed due to a lack of standing by District Court Judge Harry D. Leineweber.

The post Federal Judge Tosses CommonSpirit Health Data Breach Lawsuit Due to Lack of Standing appeared first on HIPAA Journal.