Plaintiffs in a class action lawsuit against Blackbaud sufficiently demonstrated they have standing, and the lawsuit has survived Blackbaud’s motion to dismiss.

Blackbaud is a publicly traded cloud software company with headquarters in Charleston, SC. Blackbaud provides data collection and maintenance solutions for administration, fundraising, marketing, and analytics to entities such as non-profit organizations, foundations, educational institutions, and healthcare organizations. In the course of providing its services, the company collects and stores personally identifiable information (PII) and Protected Health Information (PHI) from its customers’ donors, patients, students, and congregants.

From February 7, 2020 to May 20, 2020, cybercriminals gained access to Blackbaud’s systems, exfiltrated data, and then used ransomware to encrypt files on Blackbaud’s systems. A ransom demand was then issued by the attackers and the attackers claimed they would provide the keys to decrypt data on Blackbaud’s systems and permanently delete the data they had exfiltrated if the ransom was paid. Blackbaud decided to pay the ransom and received assurances that the stolen files had been deleted.

Following the attack, more than two dozen class action lawsuits were filed against Blackbaud. In December, the Judicial Panel on Multidistrict Litigation combined the lawsuits and, as of Thursday 1, 2021, there were 28 class action lawsuits combined in the Multidistrict Litigation with 34 named plaintiffs from 20 states. The plaintiffs assert six claims on behalf of a putative nationwide class and ninety-one statutory claims on behalf of putative state subclasses. The six types of injury the plaintiffs assert are identity theft or fraud, increased risk of identity theft in the future, time and money spent to mitigate the risk of harm, emotional distress, diminished value of data, and invasion of privacy.

The plaintiffs alleged the data breach was the result of Blackbaud’s “deficient security program” and that the company had failed to comply with industry and regulatory standards by neglecting to mitigate against the risk of unauthorized data access. The plaintiffs claimed Blackbaud was utilizing outdated servers, storing obsolete data, and maintaining unencrypted data fields.

The plaintiffs also claimed that Blackbaud only conducted a narrow internal investigation following the data breach, did not address the full scope of the attack, and downplayed the attack and the extent of the data exposed. The plaintiffs claimed the Forensic Report “improperly concludes that no credit card data was exfiltrated” because “such data could have existed in the unexamined database files.”

They also claim that timely and adequate notice about the attack was not provided, with the company waiting until July 2020 to start issuing notifications, with some individuals affected by the breach not being notified by Blackbaud’s customers until January 2021.

On May 1, 2021, Blackbaud filed a motion to dismiss the lawsuit for lack of subject matter jurisdiction. The company argued that the plaintiffs lacked Article III standing as they neither facially nor factually established that their injuries are traceable to Blackbaud’s conduct; therefore, the court lacked subject matter jurisdiction. Blackbaud also challenged whether the plaintiffs’ allegations of harm constitute injury in fact, although that challenge was later dropped.

U.S. District Judge J. Michelle Childs in Columbia, SC said in her decision on July 1, 2021, that the factual challenge to standing would not be considered because it “involves facts that are intertwined with the merits of plaintiffs’ claims.”

The facial challenge to determine whether plaintiffs allege facts that plausibly confer jurisdiction was considered, with Judge Childs concluding the plaintiffs had sufficiently alleged Blackbaud was a “plausible source” of their personal information and that there was a “plausible connection” between the types of data they alleged were compromised and the injuries they had sustained, saying “it is premature to dismiss Plaintiffs’ claims on grounds of traceability at this stage.” Blackbaud’s motion to dismiss for lack of subject matter jurisdiction was denied.

The post Federal Judge Allows Blackbaud Consolidated Class Action Data Breach Lawsuit to Proceed appeared first on HIPAA Journal.

A lawsuit has been filed against Amazon by four healthcare workers who allege their Amazon Alexa devices may have recorded conversations without their intent or consent and may have captured health information protected under HIPAA.

Amazon Alexa devices listen for words that wake up the devices and triggers them to start recording. Specifically, the devices listen for the word “Alexa,” and will then attempt to answer a question that is asked. However, the plaintiffs claim that there are other words and phrases will awaken the devices and trigger them to start recording when it is not intended by users of the devices.

The lawsuit cites a study conducted at Northeastern University which showed the devices wake up and record in response to statements such as “I care about,” “I messed up,” and “I got something.” The study also found that the devices wake up and record in response to the words “head coach,” “pickle”, and “I’m sorry.”

The plaintiffs allege “Amazon’s conduct in surreptitiously recording consumers has violated federal and state wiretapping, privacy, and consumer protection laws,” and state, “Despite Alexa’s built-in listening and recording functionalities, Amazon failed to disclose that it makes, stores, analyzes and uses recordings of these interactions at the time plaintiffs’ and putative class members’ purchased their Alexa devices.”

All four plaintiffs said they stopped using their devices altogether or purchased newer models that had a mute function out of concern that the devices may be recording sensitive information.

Amazon announced in 2019 that it would ensure that any transcripts would be deleted from Alexa servers when customers delete voice recordings. The following year Amazon said customers could opt out of human annotation of transcribed data, could configure the devices to automatically delete voice recordings older that 3 or 18 months, or could opt out entirely and not have their recordings saved at all.

The plaintiffs allege that by that time, Amazon analysts may have already listened to recordings that included protected health information. They also claimed that had Amazon informed them that the company permanently stored data or that its employees listened to recordings, they would not have purchased the devices.

Amazon said only a fraction of one percent of voice recordings are reviewed by its staff and that “Our annotation process does not associate voice recordings with any customer identifiable information.”

The post Healthcare Workers File Lawsuit Alleging Amazon Alexa Devices Violated HIPAA appeared first on HIPAA Journal.

A class action lawsuit filed by two former patients against BJC HealthCare over a March 2020 email data breach has survived two motions to dismiss.

Leaha Sweet and Bradley Dean Taylor took legal action against St. Louis-based BJC HealthCare in September 2020 after being notified that their protected health information had potentially been compromised in a data breach.

BJC HealthCare had discovered the email accounts of three of its employees had been accessed by unauthorized individuals. The email accounts contained a range of sensitive patient data including Social Security numbers, driver’s license numbers, dates of birth, medical record numbers, patient account numbers, and treatment and clinical information.

The lawsuit listed 10 counts against the defendants: Unjust enrichment, breach of contract, negligence, negligence per se, breach of covenant of good faith and fair dealing, invasion of privacy, vicarious liability, bailment, and violations of the Missouri Merchandising Practicing Act (MMPA) and Illinois Consumer Fraud and Deceptive Business Practices Act (ICFA).

The defendants – BJC HealthCare and BJC Collaborative, LLC – filed two separate motions to dismiss, arguing that the United States District Court for the Southern District of Illinois lacked personal jurisdiction over BJC HealthCare, that the plaintiffs failed to allege an injury sufficient to confer standing, that the compliant should be dismissed in its entirety for failure to state a claim, and that individual counts should be dismissed for the failure to state a claim.

In a June 29, 2021 order, Chief Judge Nancy J. Rosentengel dismissed the invasion of privacy claim as Illinois law states that the party alleging an invasion of privacy must demonstrate the act was intentional. The plaintiffs were unable to prove that was the case. The claim of bailment was also dismissed as the plaintiffs did not allege that they sought a return of their property (their protected health information) or that the health system had failed to return it.

The lawsuit will now proceed and BJC Healthcare must face the remaining 8 counts.

The post BJC HealthCare Email Data Breach Lawsuit Survives Motions to Dismiss appeared first on HIPAA Journal.

San Diego-based Scripps Health is facing multiple class action lawsuits over an April 29, 2021 ransomware attack that affected 147,267 individuals. The attack forced the 5-hospital healthcare system to take systems offline while the attack was remediated, including its patient portal. While care continued to be provided, some patients were diverted to other facilities as a precaution.

The investigation into the breach confirmed that prior to the deployment of ransomware the attacker exfiltrated documents that contained patients’ protected health information. Information compromised in the attack included names, addresses, dates of birth, health insurance information, medical record numbers, patient account numbers, and/or clinical information, such as physician name, dates of service, and/or treatment information.

A lawsuit was filed on June 1 in the San Diego County Superior Court that named Kenneth Garcia as plaintiff. The lawsuit, which seeks class action status, alleges Scripps Health was negligent for failing to prevent the theft of protected health information, which was stored on Scripps Health systems in unencrypted form. The lawsuit alleges the plaintiff suffered damages from the unauthorized release of his individually identifiable medical information. In addition to monetary damages, the lawsuit requires Scripps Health to implement appropriate security protocols to protect patient data in the future.

A second lawsuit was filed on June 7 in the San Diego County Superior Court that names Johnny Corning as plaintiff. The lawsuit also seeks class action status and alleges Scripps Health was negligent for failing to take appropriate steps to keep patients’ protected health information secure. The lawsuit alleges Scripps Health should have been aware of the risk of an attack given the number of reported attacks over the past 2 years. Scripps Health should also have been aware of the high risk of an attack as the Federal Bureau of Investigation had issued alerts warning of ongoing ransomware attacks on hospitals.

In order for lawsuits of this nature to succeed, it is necessary to establish harm has been suffered. Conning alleges harm was caused as a result of him not being unable to access the MyScripps portal, which contained important information related to his treatment. He alleges he incurred anxiety restarting his medical services and online medical classes and spent a considerable amount of time verifying the legitimacy of the security breach, monitoring his medical records for identity theft, and checking his financial accounts for misuse of his data. Both lawsuits allege financial losses were suffered and the plaintiffs face an elevated risk of identity theft and fraud. The lawsuits seek monetary damages of at least $1,000 per victim and the Conning lawsuit seeking actual damages of up to $3,000 per victim, along with reimbursement for legal costs.

A further two class action lawsuits were filed in federal court on June 21, one naming patients Michael Rubenstein and Richard Machado as plaintiffs and the other naming Kate Rasmuzzen as plaintiff. Michael Rubenstein alleges his health suffered as a result of not being able to access the patient portal. Without access to the portal, he said he had to visit a Scripps Health hematology clinic and beg a nurse to provide for him his lab orders and was unable to determine if the timing of the doses of his medication was correct. Richard Machado claimed to have had highly sensitive information about a very personal surgery exposed and has caused him great concern. Like the lawsuits naming Corning and Garcia as plaintiffs, the Rasmuzzen lawsuit is focused on the costs incurred as a result of the attack and the potential for misuse of their personal data.

The lawsuits vary in terms of specificity, although they make the same basic claim, that Scripps Health was negligent for failing to prevent the attack and stop the theft of sensitive information and for the invasion of privacy. While evidence of harm must be provided in all four lawsuits for standing, the bar is set lower in Californian court than in federal court.

While the data breach affected 147,267 individuals, Scripps Health said fewer than 3,700 individuals had either their Social Security number or driver’s license number compromised, and that highly sensitive information contained in electronic medical records was not compromised. Individuals whose Social Security number or driver’s license number was compromised have been offered complimentary credit monitoring services for 12 months.

The post Scripps Health Facing Multiple Class Action Lawsuits over Ransomware Attack appeared first on HIPAA Journal.

Colorado has joined California and Virginia in passing a comprehensive data privacy law to protect state residents. It has taken several amendments to get the Colorado Privacy Act over the line, but the Act was finally passed unanimously by the state Senate on June 8, 2021. On July 7, 2021, Colorado Governor Jared Polis signed the bill, which will now take effect on July 1, 2023.

The Colorado Privacy Act applies to all data controllers that conduct business in Colorado that control or process the personal data of 100,000 or more Colorado resident consumers in a calendar year or derive revenue or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of 25,000 or more Colorado resident consumers.

Exceptions include protected health information collected, processed, or stored by HIPAA-covered entities and their business associates, and any personal data collected, processed, sold, or disclosed pursuant to the Gramm-Leach-Bliley Act (GLBA), data regulated by the Children’s Online Privacy Protection Act of 1998 (COPPA), and individual[s] acting in a commercial or employment context, as a job applicant, or as a beneficiary of someone acting in an employment context.

The Colorado Privacy Act gives Colorado resident consumers five rights over their personal data.

• The right to opt out of the processing of personal data for targeted advertising purposes, the sale of their personal data, and automated profiling in furtherance of decisions that produce legal or similarly significant effects.
• The right to access their personal data held by a data controller.
• The right to make corrections to their personal data if inaccuracies are identified.
• The right to have their personal data deleted.
• The right to have their data provided in a portable and ready to use format.

All entities covered by the Colorado Privacy Act have responsibilities with respect to the data they collect and process.

• Transparency – Consumers must be notified about the reason for the collection and processing of personal data. If personal data is sold or used for targeted advertising, consumers must be informed. Data controllers must not require consumers to create a new account to exercise one of their rights, nor increase the cost or decrease availability based on the exercising of a consumer right.
• Purpose of collection – Consumers must be informed about the specific purposes for which personal data is being collected and processed.
• Data minimization – The personal data collected and processed must be limited to what is reasonably necessary to achieve the purpose for data collection and processing.
• Secondary data uses – Secondary data uses must be avoided if they are not compatible with the purpose for data collection and the consent provided by consumers.
• Data security – Data controllers must ensure personal data is secured to prevent unauthorized access.
• Unlawful discrimination – Data collected and processed must not violate federal anti-discrimination laws.
• Sensitive data – Sensitive data such as information related to ethnic origin, religious beliefs, mental or physical health, sexual orientation, citizenship status, genetic/biometric data, and the personal data of minors – can only be collected and processed if consumers provide their consent through an opt-in process.
• Contracts with processors – A data controller is required to enter into a contract with a data processor, with the contract stating the processor’s responsibilities under the Colorado Privacy Act.
• Data protection assessments – A data protection assessment must be conducted prior to any processing activities that have a heightened risk of harm to consumers.

The Colorado Privacy Act is due to take effect on July 1, 2023. One year after the effective date on July 1, 2024, data controllers are required to allow consumers to opt out of the processing of their personal data for targeted advertising or the sale of their data, via a user-selected universal opt-out mechanism.

If any of the provisions of the Colorado Privacy Act are violated, the violation will be considered a deceptive trade practice. Only the state Attorney General and district attorneys permitted to take action against entities for violations.

The post Colorado Privacy Act Passed and Signed into Law appeared first on HIPAA Journal.