Legal News

Mon Health Faces Class Action Lawsuit Over 493K Record Data Breach

Posted by HIPAA Journal

Mon Health is facing a class action lawsuit over a hacking incident that allowed unauthorized individuals to gain access to its network for an 11-day period in December 2021. Mon Health said it detected the breach on December 30, 2021, with the forensic investigation determining hackers accessed its network between December 9 and December 19.

Mon Health announced the security breach on February 28, 2022, and confirmed that the hackers had access to the personal and protected health information of 492,861 individuals, including information about patients, employees, providers, and contractors. The information potentially accessed and stolen included names, addresses, birth dates, Social Security numbers, Medicare claim numbers, patient account numbers, health insurance information, medical record numbers, dates of service, provider names, claims information, and medical and clinical treatment information.

The lawsuit, which names Monongalia Health Systems Inc. and affiliated hospitals, Monongalia County General Hospital Co., Stonewall Jackson Memorial Hospital Co., and Preston Memorial Hospital Corp as defendants, was filed in Monongalia County Circuit Court in West Virginia by the Clarksburg law firm, Morgan and Morgan. The lawsuit names Rachel Silbaugh, Robin Stripling, and Michael Stripling as plaintiffs, with all other individuals affected by the breach included as class members.

The lawsuit alleges the data breach occurred as Mon Health failed to implement appropriate cybersecurity measures and was not in compliance with the security standards of the HIPAA Security Rule, alleging negligence, breach of contract, breach of confidence, and breach of implied contract. While the breach notification letters were sent within the maximum timeframe permitted by the HIPAA Breach Notification Rule, the plaintiffs allege those notification letters were untimely and were “woefully deficient” in information about the breach.

Typically, when healthcare organizations experience a breach of the types of information that are sought by identity thieves, affected individuals are offered complimentary credit monitoring services. The plaintiffs claim that these were not provided and that they have been placed with the burden of checking for misuse of their personal information. The plaintiffs claim they face an immediate and ongoing threat of identity theft and fraud as a direct result of the data breach and will continue to suffer damages, including covering the cost of ongoing credit monitoring and identity theft protection services.

The lawsuit seeks class certification, reimbursement of out-of-pocket expenses, and equitable relief, citing 20 data security measures that must be implemented to better protect patient data and prevent further data breaches.

The post Mon Health Faces Class Action Lawsuit Over 493K Record Data Breach appeared first on HIPAA Journal.

LifeBridge Health Agrees to $9.5 Million Settlement to Resolve 2016 Data Breach Claims

Posted by HIPAA Journal

LifeBridge Health Inc. has agreed to settle a class action lawsuit to resolve claims from patients affected by a data breach that was discovered in 2018. The total value of the settlement is $9.475 million, which includes an $800,000 fund to cover claims from class members.

In March 2018, LifeBridge Health discovered a malware infection that provided unauthorized individuals with access to a server that hosted its electronic medical records, patient registration, and billing systems. The breach investigation determined the initial intrusion occurred 18 months previously in September 2016. The breach was disclosed by LifeBridge Health in May 2018, with the healthcare provider confirming the information of 582,174 patients had potentially been compromised, with the exposed information including names, dates of birth, addresses, diagnoses, medications prescribed, clinical and treatment information, insurance details, and a limited number of Social Security numbers.

A lawsuit – Johnson, et al. v. LifeBridge Health, Inc. – was filed in the Circuit Court for Baltimore City, MD, by the law firm Murphy, Falcon & Murphy on behalf of patients affected by the incident. The two patients named in the lawsuit, Jahima Scott and Darlene Johnson, claimed to have had their identities stolen as a direct result of the breach, with both claiming they were victims of credit card fraud shortly after the data breach occurred.

The lawsuit alleged class members had been exposed to serious harm and that their personal and protected health information was in the hands of identity thieves, which placed them at immediate and ongoing risk of identity theft and fraud. The named plaintiffs claimed to have suffered monetary losses, had financial transactions declined, experienced issues with their email accounts, fraudulent accounts were created in their names, and their identities had been used to file fraudulent claims for unemployment benefits and COVID-19 disaster small business loans.

The lawsuit alleged LifeBridge Health was negligent as it failed to follow basic security practices, which violated several privacy protection statutes in Maryland, including the Maryland Personal Information Protection Act, Maryland Social Security Number Privacy Act, and Maryland Consumer Protection Act.

LifeBridge Health did not admit to any wrongdoing and did not accept liability for the incident, but chose to settle the lawsuit to avoid further legal costs and the uncertainty of trial. Under the terms of the settlement, LifeBridge Health has agreed to create an $800,000 fund to cover claims from class members and will invest $7.9 million in additional security measures to prevent further data breaches, including data encryption, network monitoring, security awareness training, asset tracking, and multi-factor authentication. The remaining $775,000 of the total settlement amount will cover legal fees.

Class members are entitled to submit claims for reimbursement of ordinary and extraordinary losses, including up to 3 hours of lost time at $20 per hour, and a further 2 hours if they suffered extraordinary losses. Claims for ordinary losses of up to $250 per class member can be submitted to cover bank fees, credit monitoring, credit freeze, communication, and other costs, and a claim can be submitted for extraordinary losses up to a maximum of $5,000.

A final approval hearing has been scheduled for October 26, 2022. Claims must be submitted by February 1, 2023.

The post LifeBridge Health Agrees to $9.5 Million Settlement to Resolve 2016 Data Breach Claims appeared first on HIPAA Journal.

Magellan Health Settles Class Action Data Breach Lawsuit for $1.43 Million

Posted by HIPAA Journal

Magellan Health has agreed to settle a class action data breach lawsuit and will create a $1.43 million fund to cover claims from patients affected by the breach.

The lawsuit – Dearing v. Magellan Health Inc. et al. – was filed in the Arizona Superior Court against Magellan Health Inc. and Magellan RX Management, LLC on behalf of patients whose protected health information was exposed in a May 2019 phishing attack. Unauthorized individuals gained access to emails and email attachments that contained patients’ protected health information, including names, Social Security numbers, and health information. Approximately 273,000 individuals were affected and had their protected health information exposed.

The plaintiffs alleged the defendants failed to implement appropriate cybersecurity measures to prevent unauthorized access to sensitive patient data and had those safeguards been implemented, the data breach would have been prevented. The plaintiffs alleged the security failures were in violation of the Health Insurance Portability and Accountability Act, although the lawsuit was filed over the violation of state laws.

The plaintiffs also took issue with how Magellan Health handled the data breach and the delay in issuing notifications. The phishing attack occurred in May 2019, was not detected until July 2019, and notification letters were not sent to affected individuals until November 2019, 6 months after the attack. Had notifications been issued sooner, the plaintiffs argued that they could have taken steps to protect against identity theft and fraud.

The decision was taken to settle the lawsuit to prevent further legal costs and to avoid the uncertainty of trial. The defendants made no admission of wrongdoing and do not accept any liability for the data breach. Under the terms of the settlement, $1.43 million will be made available to cover claims from the class members.

All class members are entitled to submit claims of up to $225 to cover ordinary out-of-pocket expenses, such as the costs of credit reports, telephone calls, and Internet usage, and up to two hours of lost time at $15 per hour. Class members that have incurred costs related to credit monitoring and fraud resolution may also be able to claim back those costs. Claims may be submitted for extraordinary losses up to $2,500, such as monetary losses due to fraud and identity theft, as well as a further 3 hours of lost time at $15 per hour. Those claims must be supported by appropriate documentation.

Class members have until November 15, 2022, to exclude themselves or object to the settlement. The final approval hearing for the settlement is December 2, 2022, and all claims must be submitted by December 15, 2022.

The post Magellan Health Settles Class Action Data Breach Lawsuit for $1.43 Million appeared first on HIPAA Journal.

3 Dental Practices Fined for HIPAA Right of Access Violations

Posted by HIPAA Journal

The HHS’ Office for Civil Rights (OCR) has agreed to settle three HIPAA investigations of potential HIPAA Right of Access violations by dental practices. All three of the investigations were initiated after complaints from patients about the failure of their dental practices to provide them with timely access to their medical records, with one of the cases also involving an allegation of overcharging for a copy of medical records.

A patient of the Georgia-based dental and orthodontics provider, Great Expressions Dental Center of Georgia, P.C. (GEDC-GA), filed a complaint with OCR in November 2020 after being told that she could not be provided with a copy of her medical records unless she paid a $170 copying fee. The HIPAA Right of Access does permit healthcare organizations to charge patients for providing a copy of their medical records, but the costs must be reasonable and cost-based.

OCR’s investigation confirmed that the patient was not provided with a copy of her records until February 2021, 15 months after the initial request. OCR also determined that GEDC-GA’s practice of assessing copying fees resulted in the patient being charged a fee that was not reasonable and cost-based. GEDC-GA chose to settle the case and paid an $80,000 penalty and implemented a robust corrective action plan to address noncompliance with the HIPAA Right of Access.

An investigation was launched into the Chicago, IL-based dental practice, Family Dental Care, P.C. following an August 8, 2020, complaint from a former patient who alleged she had not been provided with a complete set of her medical records. The former patient submitted a request for her complete records in May 2020, but only portions of those records were provided. The patient was not provided with her full records until October 2020, more than 5 months after the initial request was submitted. OCR determined there had been a failure to provide timely access to the requested medical records, which violated the HIPAA Right of Access. Family Dental Care chose to settle the case and paid a $30,000 financial penalty and implemented a corrective action plan to address the non-compliance.

On October 26, 2020, OCR received a complaint from a patient of B. Steven L. Hardy, D.D.S., LTD (doing business as Paradise Family Dental in Las Vegas, NV). The patient alleged to have requested a copy of her and her minor child’s medical records on multiple occasions, but the records had not been provided. The requests were made between April 11, 2020, and December 4, 2020, but the records were not provided until December 31, 2020, 8 months after the initial request was submitted. OCR determined the delay in providing the records violated the HIPAA Right of Access. Paradise chose to settle the case and paid a $25,000 financial penalty and implemented a corrective action plan to address the non-compliance.

“These right of access three actions send an important message to dental practices of all sizes that are covered by the HIPAA Rules to ensure they are following the law,” said OCR Director Melanie Fontes Rainer. “Patients have a fundamental right under HIPAA to receive their requested medical records, in most cases, within 30 days. I hope that these actions send the message of compliance so that patients do not have to file a complaint with OCR to have their medical records requests fulfilled.”

The post 3 Dental Practices Fined for HIPAA Right of Access Violations appeared first on HIPAA Journal.

Bricker & Eckler Agrees to Settle Class Action Data Breach Lawsuit for $1.95M

Posted by HIPAA Journal

The Ohio law firm, Bricker & Eckler LLP, has agreed to settle a class action data breach lawsuit filed on behalf of individuals affected by a 2021 ransomware attack on the firm. Bricker & Eckler is a full-service law firm that serves many healthcare clients. The breach investigation confirmed that sensitive patient data was copied from its systems, including names, addresses, medical information, education-related information, driver’s license numbers, and Social Security numbers. The attackers had access to its systems from January 14 to January 31, 2021. Bricker & Eckler did not confirm if the ransom was paid but said the stolen data has been retrieved. The breach was reported to the HHS’ Office for Civil Rights in April 2021 as affecting 420,532 individuals and the law firm offered a 12-month complimentary membership to an identity theft protection and credit monitoring service.

A lawsuit was promptly filed on behalf of individuals affected by the attack that alleged the law firm was negligent as it had failed to implement reasonable safeguards to ensure the confidentiality of sensitive data and had not followed recognized security practices. The law firm did not admit any wrongdoing and does not accept liability for the data breach but chose to settle the lawsuit and has proposed a $1.95 million settlement.

Under the terms of the settlement, class members are entitled to submit a claim for reimbursement of losses that directly resulted from the data breach up to a maximum of $5,000. Claims can be submitted for fraudulent charges to accounts, the cost of arranging credit monitoring services, other reasonable expenses, up to 4 hours of undocumented lost time at $20 per hour, plus up to 8 hours of documented lost time at $20 per hour.

Individuals who wish to object to the settlement or remove themselves from the class must do so by November 7, 2022. Class members must submit claims no later than December 21, 2022. The final approval hearing for the settlement is scheduled for November 17, 2022.

The post Bricker & Eckler Agrees to Settle Class Action Data Breach Lawsuit for $1.95M appeared first on HIPAA Journal.

Ambry Genetics Settles Class Action Data Breach Lawsuit for $12.25 Million

Posted by HIPAA Journal

Ambry Genetics has agreed to settle a class action lawsuit that stemmed from a breach of the protected health information of 232,772 patients. In April 2020, Ambry Genetics notified patients that some of their protected health information was stored in an email account that was accessed by an unauthorized individual over a two-day period in January 2020. Emails and attachments contained sensitive patient data such as names, diagnoses, and other medical information, with a subset of patients also having their Social Security numbers exposed. The investigation was not able to determine whether any information in the email account was exfiltrated by the attackers.

A lawsuit was filed in the US District Court for the Central District of California shortly after notifications were issued that alleged Ambry Genetics had failed to implement reasonable safeguards to protect patient information and had not followed industry best practices for cybersecurity and, as a direct consequence of those failures, the protected health information of patients was compromised. The lawsuit also took issue with the delay in issuing notification letters to affected individuals.  The HIPAA Breach Notification Rule requires HIPAA-covered entities to issue notification letters within 60 days of the discovery of a data breach, but it took almost 4 months for notification letters to be issued. The lawsuit also alleged invasion of privacy, breach of contract, and violations of state privacy and business laws.

The lawsuit had been dismissed, amended, and refiled on multiple occasions over the past two years, with the latest complaint filed in December 2021. The settlement was proposed to prevent further legal costs and the uncertainty of trial, and is intended to fully resolve, discharge, and settle all claims made by the plaintiffs and class members. Ambry Genetics has not admitted to any wrongdoing and accepts no liability for the data breach.

Under the terms of the settlement, Ambry Genetics has agreed to create a $12.25 million fund, $2.25 million of which will cover the costs of notifications, administrative costs, and three years of identity theft protection and credit monitoring services to the class members.

Individuals affected by the data breach will be entitled to submit claims of up to $10,000 for reimbursement of documented out-of-pocket expenses incurred due to the data breach, up to 10 hours of documented time at $30 per hour, and up to 3 hours of ‘default time’ at $30 an hour. Individuals who were residents of California or Illinois at the time of the data breach are entitled to claim $150 compensation, in addition to any other claims, to resolve potential violations of the California Confidentiality of Medical Information Act and the Illinois Genetic Information Privacy Act. Class representatives will be entitled to claim a service award of $2,500.

In addition to the settlement, Ambry Genetics said it has spent in excess of $800,000 on issuing notifications and paying for credit monitoring services, with those costs potentially increasing to $1.4 million. Ambry Genetics said the total settlement amount is likely to increase to more than $14 million, and potentially more than $20 million when all remedial actions have been taken.

Those actions include changes to its business practices and additional security measures, including providing further security awareness training for staff members, adding warnings to external emails, and placing more stringent restrictions on access to patients’ protected health information. Ambry Genetics has also strengthened vendor management and requires all vendors to have SOC-2 certification, perform third-party risk assessments, and conduct penetration tests and phishing simulations on employees.

The post Ambry Genetics Settles Class Action Data Breach Lawsuit for $12.25 Million appeared first on HIPAA Journal.

The Urology Center of Colorado Agrees to Settle Class Action Data Breach Lawsuit

Posted by HIPAA Journal

The Urology Center of Colorado has agreed to settle a class action lawsuit that was filed in response to a 137,820-record data breach that occurred in September 2021. On November 5, 2021, the urology practice sent notification letters to its patients advising them that some of their protected health information was potentially compromised two months previously, between September 7 and September 8, 2022. Unauthorized individuals accessed its network and potentially removed files containing patient information such as names, addresses, dates of birth, Social Security numbers, medical record numbers, diagnoses, physician names, insurance provider names, guarantor names, and treatment cost information. Affected individuals were offered complimentary credit monitoring and identity theft protection services for 12 months.

A lawsuit was filed in response to the data breach on behalf of plaintiffs Kristen Snyder and Diona Lopez and other individuals similarly affected by the data breach. The plaintiffs alleged the Urology Center of Colorado was negligent for failing to implement necessary safeguards to ensure the confidentiality of patient information, including the failure to encrypt patient data, apply patches promptly to mitigate known vulnerabilities, review and update users’ account privileges, update firewalls, provide appropriate training to individuals on the procedures for handling inbound emails, and ensure appropriate security practices were followed. The lawsuit also alleged a breach of implied contract, breach of fiduciary duty, and a violation of Colorado’s data security laws. As a result of the negligence, the plaintiffs claim they face a substantial, increased, and immediate risk of fraud and identity theft.

The Urology Center of Colorado denied any wrongdoing and accepts no liability for the data breach but took the decision to settle the lawsuit to prevent ongoing legal costs and the uncertainty of trial. Under the terms of the settlement, the Urology Center of Colorado has agreed to provide compensation for documented out-of-pocket losses and lost time. Individuals who submit a claim will be eligible to receive up to $500 for documented losses, including up to 5 hours of lost time.  Claims of up to $2,500 may be submitted for extraordinary losses, and individuals who were California residents at the time of the data breach are entitled to claim an additional $50 in compensation.

Individuals that signed up for the credit monitoring and identity theft protection services offered by the Urology Center of Colorado will be entitled to claim a further two years of membership, with individuals who did not originally sign up for the services entitled to receive a 24-month membership to those services.

Class action data breach settlements often include a commitment to implement additional security measures, although this settlement contains no such commitments. The Urology Center of Colorado did state in its breach notification letters in November that additional measures were being considered to improve security.

Individuals who wish to object to or exclude themselves from the settlement have until October 10, 2022, to do so. Claims must be submitted by November 7, 2022. The final fairness hearing is scheduled for October 26, 2022.

The post The Urology Center of Colorado Agrees to Settle Class Action Data Breach Lawsuit appeared first on HIPAA Journal.

Lamoille Health Partners Facing Class Action Lawsuit Over 58K-Record Data Breach

Posted by HIPAA Journal

The Morristown, VT-based healthcare provider, Lamoille Health Partners, is facing a class action lawsuit over a June 2022 ransomware attack that affected almost 60,000 of its patients.

The attack was detected on June 13, 2022, with the investigation confirming the attackers gained access to its network the previous day. Before file encryption, the attackers potentially accessed or acquired documents from its systems that contained names, addresses, dates of birth, Social Security numbers, health insurance information, and medical treatment information.

On or around August 11, 2022, notification letters were sent to affected individuals, and complimentary identity protection and credit monitoring services were offered to patients whose Social Security numbers were potentially stolen. Lamoille Health Partners said the delay in issuing notification letters was due to the length of the investigation to establish which individuals had been affected and the types of information involved. The breach was reported to the HHS’ Office for Civil Rights as affecting 59,381 patients.

As is now common following healthcare data breaches, legal action is being taken by patients who had their protected health information exposed. The lawsuit alleges Lamoille Health Partners failed to implement appropriate safeguards to ensure the confidentiality of the protected health information stored on its systems, in violation of the HIPAA Security Rule. The plaintiff – Patricia Marshall –  says the negligence of Lamoille Health Partners means her sensitive information is in the hands of cybercriminals and she and the class members face an imminent and ongoing risk of identity theft and fraud.

The lawsuit also alleges there was an unnecessary delay in issuing notification letters to affected individuals, even though notification letters were sent within the 60-days allowed by the HIPAA Breach Notification Rule. The lawsuit – Marshall v. Lamoille Health Partners Inc. – was filed in the U.S. District Court for the District of Vermont on September 1, 2022, and seeks compensatory damages for the plaintiff and class members, and injunctive relief, requiring Lamoille Health Partners to implement further security measures to better protect patient data. The plaintiff is represented by Burlington, VT, lawyer Matthew B. Byrne of Gravel and Shea.

The post Lamoille Health Partners Facing Class Action Lawsuit Over 58K-Record Data Breach appeared first on HIPAA Journal.

House Democrats Seek Answers from Meta on its Abortion Data Sharing Policies

Posted by HIPAA Journal

Democratic leaders have demanded answers from Meta CEO Mark Zuckerberg about the role the company played in a criminal investigation in Nebraska into an alleged illegal abortion. Democrats from the Committee on Energy and Commerce wrote to the Meta CEO on August 31, 2022, to express their concern about the release of private communications that had taken place between a mother and her daughter about an abortion.

The police conducted a criminal investigation into Jessica Burgess, 41, and her daughter, Celeste Burgess, 18, over an alleged illegal abortion. The teenager is alleged to have had an illegal abortion after 20 weeks, then buried the fetus. When Roe v Wade was overturned, Nebraska was one of the states that made abortion illegal more than 20 weeks after fertilization.

The police launched an investigation after learning that a 17-year-old had unexpectedly given birth to a stillborn baby. The local police issued a warrant to Meta seeking access to conversations that had taken place between the mother and daughter on its platforms, according to a Deseret News report. Celeste Burgess was charged with three felony counts: performing an illegal abortion, performing the abortion without a licensed doctor, and then concealing a dead human body, along with two misdemeanors: concealing the death of another person and false reporting. Jessica Burgess was charged on two counts: performing an illegal abortion after 20 weeks and performing the abortion as a non-licensed doctor. Another individual, a 22-year-old man, was also charged with one misdemeanor:  attempting to conceal the death of another person.

Meta issued a statement in response to the reporting of the case in the media seeking to correct factual errors in the stories, claiming “much of the reporting about Meta’s role in a criminal case against a mother and daughter in Nebraska is plain wrong.” Meta confirmed that the warrant made no mention of abortion. “We received valid legal warrants from local law enforcement on June 7, before the Supreme Court’s decision in Dobbs v. Jackson Women’s Health Organization. The warrants did not mention abortion at all,” said Meta. “Court documents indicate that police were at that time investigating the alleged illegal burning and burial of a stillborn infant. The warrants were accompanied by non-disclosure orders, which prevented us from sharing information about them. The orders have now been lifted.”

The Committee Democrats are seeking answers from Meta on its privacy policies regarding the protection of sensitive information of users of its platform and how the company ensures private information is protected while also complying with legal obligations, especially considering the company is likely to receive further requests from law enforcement seeking access to users’ sensitive data related to illegal abortions.

“We fear it is only a matter of time before Meta is asked by law enforcement to turn over personal data of users in which they specifically cite attempting or performing abortion as the crime being investigated,” wrote the Committee Democrats. “It is completely foreseeable that Meta may be asked to turn over other sensitive data based on conversations related to assisting a friend or family member with transportation to obtain an abortion or providing money for cab fare or hotel accommodations. The possibilities are endless and are endlessly troubling.”

Chairman Frank Pallone, Jr., Chairwoman of the Subcommittee on Health, Anna G. Eshoo, Chair of the Subcommittee on Oversight and Investigations, Diana DeGette, and Chair Subcommittee on Consumer Protection and Commerce, Jan Schakowsky, have requested a briefing regarding Meta’s treatment of personal data and its policies and procedures regarding the sharing of that data with law enforcement and other outside parties.

The post House Democrats Seek Answers from Meta on its Abortion Data Sharing Policies appeared first on HIPAA Journal.