Legal News about HIPAA Compliance

Proliance Surgeons Settles Data Breach Litigation for $4,450,000

Posted by Steve Alder

The Seattle, Washington-based surgical group, Proliance Surgeons, has agreed to a settlement to resolve class action litigation over a February 2023 cyberattack and data breach.

Hackers gained access to the surgical group’s network on February 11, 2023, and exfiltrated files containing patient information. Notification letters were mailed to the 437,392 affected individuals in November 2023. Shortly thereafter, class action lawsuits started to be filed. The HIPAA Journal reported on one of those lawsuits in December 2023 (see below). That lawsuit was one of eleven class action complaints filed by victims of the data breach. Due to overlapping claims, and to conserve resources, the lawsuits were consolidated into a single complaint – In re: Proliance Surgeons Data Breach Litigation – in the Superior Court of the State of Washington in and for King County.

The consolidated lawsuit alleged that Proliance Surgeons failed to implement the necessary safeguards to protect private personal and protected health information on its network and as a direct consequence of that failure, hackers were able to obtain unauthorized access to patient data such as names, Social Security numbers, dates of birth, telephone numbers, medical information, diagnosis and treatment information, health insurance information, and medical record numbers. The lawsuit also took issue with the length of time it took to issue notification letters to the affected individuals, who received notification letters more than 280 days after the data breach was discovered.

While Proliance Surgeons offered the affected individuals a complimentary 12-month membership to a credit monitoring service, the plaintiffs claimed the offer was woefully inadequate, and that the data breach had “caused irreparable harm to their personal, financial, reputational, and future well-being.” The lawsuit asserted claims for negligence, breach of implied contract, unjust enrichment, and a violation of the Washington Consumer Protection Act.

The defendant denied and continues to deny all allegations in the litigation, all charges of wrongdoing or liability, and claims that the plaintiffs and class members suffered any cognizable damage or harm as a result of the incident. However, despite that position, the decision was taken to settle the litigation to avoid the uncertainty, risk, expense, and burden involved with defending the litigation. Class counsel and the class representatives believe that the negotiated settlement is fair and in the best interests of the class members.

Under the terms of the settlement, Proliance Surgeons has agreed to establish a $4,450,000 common settlement fund to cover benefits to the class members, after attorneys’ fees and expenses, settlement administration and notice costs, and service awards for the class representatives have been deducted. Class members may claim a two-year membership to the CyEx Medical Shield Complete medical information protection and monitoring service. Class members who have experienced out-of-pocket losses due to the incident may submit a claim for reimbursement of documented, unreimbursed losses. Claims for reimbursement have been capped at $5,000 per class member.

Regardless of whether a claim is submitted for reimbursement of losses, a pro rata cash payment of up to $599 may be claimed. The cash payments will depend on the number of individuals electing to receive credit monitoring services, cash payments, and reimbursement of losses. The cash payments may be substantially lower than the $599 maximum. The deadline for exclusion from the settlement and objection is April 28, 2026. Claims must be submitted by May 28, 2026, and the final fairness hearing has been scheduled for June 26, 2026.

December 5, 2023: Proliance Surgeons Sued Over Ransomware Attack and Data Breach

A class action lawsuit has been filed against Proliance Surgeons, a Seattle, Washington-based surgery group, over a recently disclosed ransomware attack and data breach that has affected almost 437,400 individuals.

The group operates around 100 surgery centers in the state and treats more than 800,000 patients each year. On May 24, 2023, a third-party forensic investigation into a cyberattack confirmed that hackers had access to files containing patient data and that they had removed “a limited number of files” from its network on February 11, 2023.  The data compromised in the attack included names, contact information, Social Security numbers, financial information, treatment information, driver’s license numbers, and usernames and passwords. Notifications were issued on November 21, 2023.

A lawsuit has been filed in federal court in Seattle by plaintiff and former patient, Alicia Berend, and similarly situated individuals whose sensitive information was compromised in the cyberattack. The lawsuit alleges Proliance Surgeons failed to adequately protect patient data as required by federal and state law and in accordance with its internal security policies, and that the data security failures constituted a violation of the Health Insurance Portability and Accountability Act (HIPAA).

The lawsuit also references an earlier security breach where unauthorized individuals had access to its online payment system for seven months between November 2019 and June 2020, allowing access to names, zip codes, and payment card information. Following that incident, Proliance Surgeons said it would be enhancing its security measures to prevent similar incidents in the future. The earlier security breach is not shown on the HHS’ Office for Civil Rights (OCR) website, which indicates either the breach was not reported to OCR, that Proliance Surgeons determined protected health information had not been compromised, or the breach affected fewer than 500 individuals. The lawsuit claims that two major security breaches in a little over 3 years demonstrate a pattern of negligence with respect to data security.

The lawsuit also takes issue with the length of time taken to discover that patient data was involved, which occurred 102 days after the security breach was detected, and Proliance Surgeons then failed to issue notification letters to the affected individuals until November 21, 2023 – 283 days after the data breach occurred. The lawsuit claims that the plaintiff and class were kept in the dark about the breach, thus depriving them of the opportunity to mitigate their injuries in a timely manner.

The lawsuit claims the plaintiff and class have suffered widespread injury and monetary damages, and that the plaintiff has already suffered from identity theft and fraud. She has received emails indicating someone has used her identity for various out-of-state activities, including inquiries into properties in Florida, and has also received an increased number of spam messages and phone calls, and now fears for her personal and financial security. The plaintiff claims that she has suffered anxiety, sleep disruption, stress, fear, and frustration, and that these injuries go far beyond mere worry or inconvenience.

The lawsuit alleges negligence, breach of implied contract, breach of fiduciary duty, invasion of privacy, unjust enrichment, and violations of the Washington Consumer Protection Act, Washington Data Breach Disclosure Law, and Washington Uniform Health Care Information Act (UHCIA). The lawsuit seeks class action certification, a jury trial, compensatory, exemplary, punitive, and statutory damages, and attorneys’ fees and legal costs. The plaintiff and class are represented by Samuel J. Strauss of the law firm, Turke & Strauss LLP.

The post Proliance Surgeons Settles Data Breach Litigation for $4,450,000 appeared first on The HIPAA Journal.

$49.99M Settlement Agreed to Resolve Class Action Data Breach Lawsuit Against Heritage Provider Network et al

Posted by HIPAA Journal

A $49.99 million settlement has received preliminary approval from the court to resolve class action litigation against Heritage Provider Network, Regal Medical Group, and eight co-defendants over a December 2022 data breach that affected approximately 3,413,000 individuals.

California-based Heritage Provider Network (Heritage) and the affiliated defendants operate as one of the largest physician-owned integrated healthcare networks in the United States. Heritage, arranged to provide medical services for the plaintiffs and class members through affiliates such as Regal Medical Group. On or around December 1, 2022, hackers gained access to servers containing patient data and exfiltrated sensitive data such as names, addresses, dates of birth, Social Security numbers, and healthcare information. The investigation revealed the hackers had access to those servers until the attack was discovered on December 8, 2022, and between December 1 and 2, 2022, they are alleged to have exfiltrated personally identifiable information (PII) and protected health information (PHI). The defendants started sending notification letters to the affected individuals on February 2, 2023.

The first class action lawsuit over the data breach was filed on February 9, 2023, and it was followed by a further 25 lawsuits. The court designated Head v. Regal Medical Group, Inc., et al as the lead case and stayed all remaining actions, with all actions consolidated into the lawsuit Head, et al. v. Regal Medical Group, Inc., et al.  The other defendants named in the consolidated lawsuit are Lakeside Medical Group, ADOC Medical Group, Greater Covina Medical Group, Affiliated Doctors of Orange County Medical Group, Arizona Priority Care, Community Surgery Center of Glendale, Pacific Family Hospice, and Valley’s Best Hospice.

The lawsuit alleges the defendants were negligent for failing to implement reasonable and appropriate security measures to protect their IT infrastructure and sensitive patient data. The lawsuit also asserted claims of breach of implied contract, unjust enrichment, unfair business practices, and violations of the California Consumer Privacy Act of 2018, the California Confidentiality of Medical Information Act, Unfair Competition Law, the FTC Act, and the Health Insurance Portability and Accountability Act.

The defendants maintain there was no wrongdoing and there is no liability, while the plaintiffs believe they have made valid claims. To prevent further costs, protracted litigation, and to avoid the risks and uncertainty of trial, all parties engaged in discussions to resolve the litigation. It took three mediation sessions for all parties to agree on a settlement in principle to resolve the litigation. The terms of the settlement have now been finalized, and the settlement has received preliminary approval from Superior Court Judge Timothy P. Dillon of the Superior Court of the State of California, County of Los Angeles.

Under the terms of the settlement, the defendants will establish a $49,995,000 settlement fund from which attorneys’ fees and expenses, settlement administration costs, and service awards for the seven named plaintiffs will be paid. The remainder of the settlement will be used to pay benefits to the plaintiffs and class members. All plaintiffs are entitled to claim three years of comprehensive identity monitoring services. Claims may also be submitted for reimbursement of documented, unreimbursed out-of-pocket losses up to a maximum of $10,000 per class member, capped at $2,000,000. If that total is reached, claims will be paid pro rata. A claim may also be submitted for reimbursement of documented lost time dealing with issues arising from the data breach. Up to seven hours can be claimed at $30 per hour, or a maximum of $210. These claims will be capped at $1,000,000 and will be paid pro rata if that total is reached.

All plaintiffs are also entitled to claim a cash payment. The cash payments will be paid from the remainder of the settlement fund after costs, expenses, credit monitoring costs, and claims have been paid. The cash payments are expected to be between $68.72 and $357.97, depending on participation rates and the number of approved claims. The deadline for objection to and exclusion from the settlement is November 24, 2025. The deadline for submitting a claim is December 22, 2025, and the final approval hearing has been scheduled for January 28, 2025.

February 23, 2023: Multiple Lawsuits Filed Against Regal Medical Group Over 3.3 Million-Record Ransomware Attack

Several class action lawsuits have been filed against Regal Medical Group and affiliated healthcare providers following the February 1, 2023, announcement a HIPAA compliance breach where the protected health information (PHI) of up to 3,300,638 individuals had potentially been stolen in a December 2022 ransomware attack.

The attack affected Regal Medical Group, the Heritage Provider Network, and several affiliated healthcare providers, including Lakeside Medical Organization, A Medical Group, Inc., ADOC Acquisition Co., Greater Covina Medical Group Inc., and Affiliated Doctors of Orange County. The attack was detected on December 2, when employees started experiencing difficulty accessing data.

The forensic investigation revealed the attack started on or before December 1, with sensitive data exfiltrated from its servers on December 1. The stolen files included PHI such as names, phone numbers, addresses, dates of birth, diagnosis and treatment information, laboratory test results, prescription data, radiology reports, health plan member numbers, and Social Security numbers. Affected individuals were offered a 12-month membership to a credit monitoring service.

It is now common for multiple lawsuits to be filed after healthcare data breaches, so it is no surprise that so many lawsuits have been filed after an attack of this magnitude. One of the biggest concerns raised in the lawsuits was how the attackers were able to gain access to so much data, much of which was highly sensitive and could be misused in many different ways. The lawsuits were filed in the California superior state court and federal court, and each makes similar claims against Regal Medical Group and the Heritage Provider Network, including negligence, negligence per se, breach of implied contract, unjust enrichment, and unfair business practices. The lawsuits allege violations of the California Consumer Privacy Act of 2018, the California Confidentiality of Medical Information Act, Unfair Competition Law, the FTC Act, and the Health Insurance Portability and Accountability Act.

The lawsuits also take issue with the time taken to issue notifications about the breach, which started to be issued on February 1, 2022, when the data breach occurred on December 1, 2022. While the notifications were issued within the time frame allowed by the HIPAA Breach Notification Rule, that Rule also states that notifications should be issued without undue delay. One of the lawsuits also takes issue with the information provided in the notifications, which failed to provide full information on the nature of the breach, such as for how long the attackers had access to the stolen data.

One of the lawsuits, Timothy Head vs. Regal Medical Group Inc, Heritage Provider Network Inc. (Cole & Van Note), claims the defendants intentionally, willfully, recklessly, or negligently failed to take and implement adequate and reasonable measures to ensure that representative plaintiff(s)’ and class members PHI/PII was safeguarded,” also claims the defendants were negligent for failing to encrypt data.

Sam Abedi And Farnaz Doroodian v. Heritage Provider Network, Inc. and Regal Medical Group, Inc. (Zimmerman Reed LLP/ The Johnson Firm) and David Rodriguez v. Regal Medical Group (Wucetich & Korovilas LLP) make similar claims, including the defendants were well aware of the high prevalence of data breaches and had the resources available to protect data but failed to invest sufficiently in data security, the remediation of vulnerabilities, staff training, and testing security controls.

Lynn Austin vs. Regal Medical Group, Inc. (Parker & Minnie, LLP & Mason LLP) claims the plaintiffs have suffered actual and concrete injury, including out-of-pocket expenses, loss of valuable rights and protections, heightened stress, fear, anxiety, and risk of future invasions of privacy, and mental and emotional distress.

The lawsuits seek class action certification, a jury trial, actual and punitive damages, and injunctive relief, including an order from the courts to prohibit the defendants from engaging in unlawful acts and deceptive business practices and to ensure that a comprehensive information security program is implemented to protect against future data breaches.

The post $49.99M Settlement Agreed to Resolve Class Action Data Breach Lawsuit Against Heritage Provider Network et al appeared first on The HIPAA Journal.

The Christ Hospital Agrees to Pay up to $7 Million to Resolve Pixel Litigation

Posted by HIPAA Journal

The Christ Hospital in Cincinnati, Ohio, has agreed to pay up to $7 million to settle a consolidated class action complaint lawsuit over its use of tracking tools on its MyChart patient portal. Tracking tools are added to websites and record user data that can be used to improve the websites; however, these tools often transmit the collected data to third parties. The information can be linked with individual users and is often used for marketing and advertising purposes.

These tools are commonly used on websites and apps, but when used by healthcare providers, especially on websites that require users to log in, they can collect sensitive health data. If that information is transmitted to a third party without a valid business associate agreement in place, or if consent is not obtained to share the data with a third party, these tools violate HIPAA. Several class action lawsuits against healthcare providers have been resolved in recent weeks that alleged violations of federal and state laws related to the use of website tracking technologies, and Meta was found liable by a California Jury in one of the few such lawsuits to go to trial.

Three lawsuits were filed against The Christ Hospital over the use of these tracking tools, which were consolidated into a single action – In Re The Christ Hospital Pixel Litigation – in the Court of Common Pleas, Hamilton County, Ohio, as they had overlapping claims and were based on similar facts. The consolidated lawsuit alleged that The Christ Hospital encouraged its patients to use its website to book appointments, locate facilities, communicate symptoms, search for medical information and treatment options, sign up for classes, and access the patient portal to review health records, fill prescription refills, and complete medical forms.

The website included tracking tools such as pixels, web beacons, and cookies that collected sensitive data and disclosed it to Meta and Google. The information disclosed on the website could allow third parties to reasonably infer that a patient was being treated for a specific health condition, including cancer, pregnancy, or addiction. The plaintiffs allege that these tools were added to the website, collected data, and transmitted that information to third parties without their knowledge or consent.

The data collected by Meta Pixel was tied to individuals by their Facebook ID, and Google was sent data from Google Analytics code and could identify individuals via the Chrome Browser and Google devices, which made the intercepted data personally identifiable. The lawsuit claimed the use of the tools violated federal (HIPAA & the FTC Act) and state law (Ohio Wiretapping law, and the Ohio Consumer Sales Practices Act). The lawsuit also asserted claims of breach of confidence, invasion of privacy, breach of implied contract, unjust enrichment, and negligence.

The Christ Hospital maintains there was no wrongdoing; however, it chose to settle the litigation to avoid the risks and uncertainties associated with a trial. Under the terms of the settlement, The Christ Hospital will establish a $4,500,000 settlement fund to cover attorneys’ fees and expenses, settlement administration costs, service awards for class representatives, CyEx’s Privacy Shield Pro memberships, and cash payments. If, after covering all of those costs and expenses, there are insufficient funds remaining to pay class members a minimum of $37.50, then a further $2,500,000 will be added to the settlement fund. Should the $7 million total be exceeded, then claims will be subject to a pro rata reduction.

The Christ Hospital has also agreed to injunctive relief and will not transmit or otherwise permit Facebook to view or access individually identifiable health information and demographic information covered by HIPAA. That means any information related to past, present, or future physical or mental health or condition of an individual, which identifies that individual or could be used to identify that individual. The injunctive relief will apply to the Patient Portal, including forms and Health Risk Assessments, for a period of two years.

January 27, 2023: Lawsuit Alleges Christ Hospital Website Sent Patient Data to Meta

Earlier this month, a lawsuit was filed against The Christ Hospital in Cincinnati, OH, alleging third-party tracking code had been added to its website that was transmitting sensitive patient data to Meta and other third parties without obtaining authorization from patients.

An investigation by The Markup last summer revealed that one-third of the top 100 hospitals in the United States had Meta pixel tracking code on their websites, several of which were confirmed as having added the code to their password-protected patient portals. In some instances, the code was transmitting patient data to Meta, such as if website visitors were logged into their Facebook accounts while browsing the hospital websites. Tracking code is also provided by others, such as Google, which can similarly transmit data based on the interactions of users on websites.

Following the investigation, several healthcare organizations announced data breaches related to tracking technologies that have resulted in the impermissible disclosure of patient information. The HHS’ Office for Civil Rights recently issued guidance on the use of tracking technologies on hospital websites, confirming that these technologies have the potential to violate the HIPAA Rules, and the use of these technologies without patient authorizations or a business associate agreement is likely to be a reportable data breach. The Christ Hospital does not appear to have announced any such breach to date.

The lawsuit – Doe v. The Christ Hospital – was filed on January 10, 2023, by attorney James Eugene Burke III in Hamilton County Court but has since been moved to federal court. According to the lawsuit, The Christ Hospital website has a search engine that patients are encouraged to use to find physicians within its network, and patients can schedule appointments with those physicians online. The hospital website allegedly includes Meta Pixel and other third-party code, which collects information about the activities of website users and transmits that information to Meta and others, with the information potentially used to serve patients with targeted adverts on Facebook and other Meta platforms.

The lawsuit alleges patients who searched for cancer transmits, mental health care, and even sexually transmitted infections could be targeted with adverts related to their searches on the site. The lawsuit also alleges that third-party code was included on the MyChart patient portal, which could potentially transmit communications with physicians to third parties without patient authorization, in violation of the HIPAA Rules.

The lawsuit names Jane Doe as plaintiff and seeks class action status to cover all similarly affected patients. The lawsuit seeks a jury trial and damages in excess of $25,000. The Christ Hospital maintains it is not selling patient data to Meta or other third parties and is investigating the claims made in the lawsuit.

The post The Christ Hospital Agrees to Pay up to $7 Million to Resolve Pixel Litigation appeared first on The HIPAA Journal.