Planned Parenthood Los Angeles (PPLA) is facing a class action lawsuit over a ransomware attack that was discovered on October 17, 2021. The cyberattack exposed the protected health information of more than 409,759 patients. In the notification letters sent to affected individuals on November 30, 2021, PPLA explained that its systems were breached on October 9, 2021, and the hackers had access to files containing PHI until October 17, when they were ejected from the network.

The files on the affected systems contained names, addresses, birth dates, diagnoses, treatment, and prescription information, and some files were exfiltrated from its network prior to file encryption. PPLA said it has found no evidence to suggest patient data has been misused.

A PPLA patient whose PHI was exposed in the data breach has taken legal action over the incident. The lawsuit was filed in the U.S. District Court of Central California and alleges the patient, and class members, have been placed at imminent risk of harm as a result of the theft of their sensitive health data, which included electronic health records that detail the procedures performed by PPLA such as abortions, treatment of sexually transmitted diseases, emergency contraception prescriptions, cancer screening information, other highly sensitive health data.

The lawsuit also references the timing of the attack, which coincided with Supreme Court debates on abortion, and says the exposure of information on abortion procedures at such a time makes it more likely that patients will suffer harm. In addition to facing an imminent risk of harm, affected individuals are likely to continue to suffer economic and actual harm and have lost control of their healthcare data. They have also incurred out-of-pocket expenses as a direct result of the data breach such as costs and time spent securing their accounts, monitoring for identity theft and fraud, and taking action to prevent misuse of their personal information. The lead plaintiff alleges she has suffered actual harm as a result of the breach, including stress and anxiety, and has also suffered damage and diminution in the value of her personal information.

While there is no private cause of action in the Health Insurance Portability and Accountability Act (HIPAA), the lawsuit alleges PPLA has violated HIPAA by failing to ensure the confidentiality of patient data and insufficient cybersecurity measures had been put in place to prevent unauthorized PHI access. The lawsuit also states that this is the third data breach PPLA has suffered in the past three years.

In addition to the HIPAA violations, the lawsuit claims PPLA also violated the California Confidentiality of Medical Information Act (CMIA) and the California Consumer Privacy Act (CCPA).

The lawsuit seeks compensatory and statutory damages, injunctive relief, investment in cybersecurity measures to ensure further breaches do not occur, and for affected individuals to be provided with identity theft protection and restoration services and to be covered by an identity theft insurance policy.

The post Planned Parenthood Los Angeles Facing Class Action Lawsuit Over October 2021 Ransomware Attack appeared first on HIPAA Journal.

A medical biller in the Tampa Bay area of Florida has pleaded guilty to four counts of healthcare fraud, four counts of aggravated identity theft, two counts of failing to file a tax return, and one count of filing a false tax return.

Joshua Maywalt, 40, of Tampa, worked as a medical biller at a Clearwater company that provided credentialing and medical billing services to a range of healthcare provider clients in Florida. In his capacity as a medical biller, Maywalt was able to access the company’s financial, medical provider, and patient information.

Maywalt was assigned to a Tampa Bay area physician’s account and submitted claims to Florida Medicaid HMOs for services provided by that physician to recipients of Medicaid. Maywalt wrongfully accessed the company’s patient information and used the name and identification number of the physician to submit false and fraudulent claims to a Florida Medicaid HMO for services that Maywalt claimed were provided by the physician when they had not been. The “pay to” information on the claims for the fictitious medical services was changed to account numbers under Maywalt’s control.

In the tax years of 2017 and 2018, Maywalt failed to file a tax return with the Internal Revenue Service and filed a false tax return for the 2019 tax in which he substantially underreported his income as he did not include the amounts he paid into his bank accounts from his fraudulent billing activities.

According to the United States Attorney’s Office, Middle District of Florida, Maywalt will forfeit $2.2 million in funds and real estate property that are directly traceable to his offenses. He now faces a maximum jail term of 53 years – 10 years for each healthcare fraud count, up to 3 years for filing a false tax return, up to 2 years for each count of a failure to file a tax return and a mandatory 2 years for each count of aggravated identity theft. The aggravated identity theft sentences will run consecutively.

The case was investigated by the Department of Health and Human Services’ Office of the Inspector General, the Federal Bureau of Investigation, the Florida Attorney General’s Medicaid Fraud Control Unit, and the Internal Revenue Service – Criminal Investigation.

The post Medical Biller Faces Decades in Jail for Healthcare Fraud, Identity Theft, and Tax Offenses appeared first on HIPAA Journal.

San Juan Regional Medical Center in Farmington, New Mexico is facing a class action lawsuit over a 2020 data breach that was announced in June 2021. The breach investigation confirmed an unauthorized individual gained access to its network and exfiltrated files containing sensitive patient data between September 7, 2021, and September 8, 2021.

The data breach was initially reported to the HHS’ Office for Civil Rights as affecting 500 individuals, with San Juan Regional Medical Center saying at the time that at least 500 individuals had been affected. When the total number of individuals affected by a security breach is not known, breaches can be reported to OCR and the breach report updated when further information is known. The breach investigation later confirmed that the protected health information (PHI) of 68,792 individuals had potentially been stolen in the attack.

While data theft was confirmed, the hospital has not uncovered any evidence to suggest any patient’s PHI has been misused and individuals whose Social Security number was compromised have been offered complimentary credit monitoring and identity theft protection services for 12 months.

The lawsuit was filed on October 7, 2021, on behalf of Jeremy Henderson and all other San Juan Regional Medical Center patients affected by the data breach. The lawsuit alleges the way San Juan Regional Medical Center handled patient data was negligent, which resulted in sensitive information being exposed and stolen by hackers. The lawsuit also alleges the hospital failed to implement appropriate safeguards to protect patient data, in violation of the Health Insurance Portability and Accountability (HIPAA) Act.

The lawsuit also takes issue with the length of time it took to issue notifications. Henderson said he was notified about the breach on September 13, 2021, more than a year after his PHI was stolen.

The lawsuit alleges the plaintiff and class members face a substantial risk of identity theft and fraud as a result of the theft of their protected health information and will be required to spend time and effort monitoring their accounts and statements and taking other steps to protect against identity theft and fraud, and that 12 months of credit monitoring and identity theft protection services is insufficient. The lawsuit seeks unspecified damages.

The post New Mexico Hospital Hit with Class Action Lawsuit over 2020 Data Breach appeared first on HIPAA Journal.

An Eskenazi Health patient whose protected health information was stolen in an August 2021 ransomware attack is suing the healthcare provider over the data breach.

It is now common for ransomware gangs to exfiltrate sensitive data prior to using ransomware to encrypt files. The stolen data is used to threaten victims to encourage payment of the ransom, as was the case in the Eskenazi Health ransomware attack. Indianapolis, IN-based Eskenazi Health discovered the attack in early August and immediately shut down its computer systems in an attempt to prevent further unauthorized access and contain the attack. The healthcare provider took the decision to divert ambulances and cancel certain appointments as a safety measure while its electronic medical record system was offline.

The investigation into the breach determined its systems had first been compromised in May and files containing sensitive patient data had been exfiltrated from its systems. Notification letters started to be sent to affected patients in early November and patients were informed of the data theft and were offered complimentary identity theft protection and credit monitoring services. At the time of issuing notifications, there had been no reports of any misuse of patient data, although some patient data had been published on the gang’s data leak site. The breach report submitted to the HHS’ Office for Civil Rights in early October indicates 1,515,918 patients were affected by the breach.

Eskenazi Health said the stolen data related to employees, providers, patients, former patients, and vendors and included names, addresses, telephone numbers, email addresses, dates of birth, medical record numbers, patient account numbers, diagnoses, clinical information, physicians’ names, insurance information, prescriptions, driver’s license numbers, passport numbers, face photographs, Social Security numbers, and credit card information.

Eskenazi Health patient Terri Ruehl Young was one of the individuals impacted by the data breach. In her lawsuit Young claims a fraudulent charge of $370 was applied to the credit card she used to pay for her treatment and her Equifax credit report showed an attempt to change her name.

The lawsuit alleges patients placed their trust in Eskenazi Health to secure its systems and protect patient data, but the healthcare provider betrayed that trust by failing to implement up-to-date security practices and appropriate safeguards to protect patient data. The lawsuit alleges negligence, breach of contract, and unjust enrichment.

The lawsuit also takes issue with the length of time it took Eskenazi Health to notify patients about the data breach. The lawsuit claims that notification letters were sent more than 6 months after hackers first breached its systems, and 3 months after the breach was discovered by Exkenaki Health. The HIPAA Breach Notification Rule requires notifications to be issued within 60 days of the discovery of a data breach.

The lawsuit, which was filed by Cohen and Malad and John Steinkamp & Associates, seeks class action status and requests a jury trial. A spokesperson for Eskenazi Health said the lawsuit has yet to be formally served.

The post Patient Sues Eskenazi Health Over Ransomware Attack and Misuse of Her Data appeared first on HIPAA Journal.