MedStar Health Agrees to $1.35 Million Settlement to Resolve Class Action Data Breach Litigation

Posted by Steve Alder

MedStar Health has agreed to settle class action litigation stemming from a 2023 data breach that affected more than 183,000 individuals. MedStar Health will create a $1.35 million settlement fund to cover attorneys’ fees, legal costs and expenses, and claims from class members for reimbursement of out-of-pocket expenses fairly traceable to the data breach.

MedStar Health, the largest healthcare provider in Maryland and Washington, D.C., provides medical services through 120 entities, including 10 hospitals. Between January 25, 2023, and October 18, 2023, an unauthorized third party gained access to the email accounts of three employees and accessed or obtained the protected health information of 183,079 patients. The individuals were notified about the data breach on May 4, 2024.

Shortly after mailing notification letters, a class action lawsuit was filed by Gwendolyn Riddick individually and on behalf of similarly situated individuals. A further five class action lawsuits were filed by other MedStar Health patients. Since all six lawsuits were materially and substantively identical and had overlapping claims, they were consolidated into a single action, In re MedStar Health Data Security Incident, in the U.S. District Court for the District of Maryland. The plaintiffs alleged that MedStar Health failed to implement reasonable and appropriate safeguards to protect the sensitive data it stored on its network.

MedStar Health denies any wrongdoing and disagrees with the claims and contentions in the lawsuit; however, MedStar agreed to a settlement to avoid the cost and risk of a trial and any possible appeals. The $1,350,000 settlement fund will be used to pay attorneys’ fees up to $450,000, settlement administration costs up to $250,000, class representative awards of $2,500 for each of the six named plaintiffs, attorneys’ expenses, and medical data monitoring costs. The remainder of the settlement fund will be used to cover claims from class members, who are U.S. residents who are current or former MedStar patients or employees who were notified that their data was exposed between January 25, 2023, and October 18, 2023.

Under the terms of the settlement, class members may claim one of two cash payments plus a one-year membership to a medical and healthcare data monitoring service. Class members may submit a claim for reimbursement of documented losses up to a maximum of $5,000 per class member, or they may alternatively claim a cash payment, which is estimated to be $100. The cash payments may be adjusted based on the number of valid claims received.

The deadline for objecting to and opting out of the settlement is September 14, 2025. The deadline for filing a claim is October 14, 2025. The settlement has received preliminary approval from the court, and the final fairness hearing is scheduled for November 4, 2025.

The post MedStar Health Agrees to $1.35 Million Settlement to Resolve Class Action Data Breach Litigation appeared first on The HIPAA Journal.

The Harris Poll Survey Reveals Growing Concern About Workplace Safety in Healthcare

Posted by Steve Alder

A recent survey by The Harris Poll has revealed that three out of five (59%) healthcare workers are concerned about safety in the workplace, and almost two out of five healthcare workers have considered leaving their employment due to safety concerns as incidents of violence in the workplace increase.

The survey was conducted between April 21 and May 7, 2025, on 1,027 U.S. healthcare workers who frequently interact with patients or their families.  The biggest concerns among healthcare workers were verbal harassment from patients (81%), aggressive behavior/threats from patients (77%), verbal harassment from non-patients (62%), and aggressive behavior/threats from non-patients (59%). More than one-fifth (21%) of healthcare workers said they worry about verbal harassment most of the time or every time they go to work.

These concerns are far from unfounded. Data from the U.S Bureau of Labor Statistics shows healthcare workers are five times more likely to experience violence in the workplace than workers in other industries, and multiple surveys suggest workplace violence is on the rise. The Harris Poll survey revealed that 85% of healthcare workers have experienced verbal harassment from patients, 79% have experienced aggressive behavior/threats from patients, and 43% have experienced physical assaults from patients.  More than half of respondents (54%) said they have felt threatened by patients or their families/visitors at work, and said their co-workers have expressed concern about safety at work (53%).

Female workers were more likely than male workers to experience or witness verbal harassment by patients (88% vs 80%), aggressive behavior from patients (81% vs 74%), and physical assaults by patients (48% vs 34%), with nurses twice as likely as doctors to be physically assaulted. Younger workers are more likely to experience or witness verbal harassment and physical assaults than older workers. There was a 41-percentage-point gap between Gen Z and Boomers for physical assaults.

The survey revealed workplace safety fears are getting worse for nurses and doctors, with 61% of nurses and 53% of doctors saying they are more concerned about physical safety at work than when they started working in healthcare, and 40% of nurses and 27% of doctors were more concerned about personal safety than a year ago. Despite these genuine concerns about workplace safety, healthcare organizations are failing to implement appropriate safeguards to protect their workers, with 41% of respondents saying they only have minimal security in their workplace. The majority of healthcare workers (77%) said safety measures haven’t improved in the past 12 months, and 82% said they wanted increased security measures at work. The measures most wanted for peace of mind were on-site security guards (63%), weapon detection technology (49%), and panic buttons (48%).

The Harris Poll survey paints a similar picture to data from other surveys exploring healthcare workplace safety. A survey conducted by National Nurses United in 2024 revealed that a majority of nurses have experienced at least one type of workplace violence in the past year, and almost half have seen an increase in rates of violence in the workplace.  A survey conducted by the American College of Emergency Physicians in January 2025 revealed 91% of healthcare workers had personally experienced violence at work or knew of a colleague who was a victim of workplace violence, and 40% of healthcare workers said they were aware of an attack on a healthcare worker in a trauma center that resulted in moderate to severe disability or death.

It is no surprise, given the stresses of the job and fears of violence, that many healthcare workers are planning on leaving the profession. NCSBN’s 2024 National Nursing Workforce Study revealed 138,000 nurses have left the workforce since 2022, and almost 40% of nurses plan to leave the workforce by 2029. While those figures include healthcare workers who will be retiring, there is concern that there will be staff shortages due to the difficulty attracting young people into healthcare and retaining them, especially since younger workers are most likely to experience verbal abuse and workplace violence.

Alana O’Grady, Vice President of Communications & Public Affairs at Verkada, said the data clearly shows an urgent need for healthcare organizations to invest in security infrastructure, but this is far from just a safety issue. “This is driving lasting impact in the industry, with workplace violence driving upwards of $18 billion in costs for the healthcare system annually and threatening to drive an even greater cost if labor shortages worsen.”

Steps are being taken to improve safety at work by the Occupational Safety and Health Administration (OSHA), and new legislation has been introduced to better protect healthcare workers. In May, the bipartisan Save Healthcare Workers Act was introduced, which aims to give healthcare workers similar protections as workers in the airline industry by making attacks on healthcare workers a felony. That said, similar legislation has been introduced in the past but has failed to be passed by Congress.

The post The Harris Poll Survey Reveals Growing Concern About Workplace Safety in Healthcare appeared first on The HIPAA Journal.

HHS-OIG Imposes Penalties on Skilled Nursing Facilities for Employing Excluded Individuals

Posted by Steve Alder

The U.S. Department of Health and Human Services Office of Inspector General (HHS-OIG) has recently announced enforcement actions against entities alleged to have employed excluded individuals who provided items or services that were billed to federal healthcare programs. On May 29, 2025, HHS-OIG announced a $1,565,374.11 settlement agreement with 19 skilled nursing facilities to resolve allegations that they knew or should have known that they employed individuals who were excluded from federal healthcare programs.

Sundance Creek Post Acute, California Escondido Post Acute, California
Jurupa Hills Post Acute, California Crystal Cove Care Center, California
Redwood Cove Healthcare Center, California Huntington Valley Healthcare Center, California
Houston Transitional Care, Texas Napa Post Acute, California
Norwood Towers Post Acute, Ohio Sunnyvale Post Acute Center, California
Stoney Point Healthcare, California Trellis Centennial, Nevada
San Diego Post Acute, California Mirage Post Acute, California
Crystal Ridge Care Center, California Aviara Healthcare, California
Concord Post Acute, California Westview Healthcare Center, California
Balboa Nursing & Rehabilitation Center, California

The second settlement agreement involved a $35,597.37 penalty for CareLink Home Health, LLC in Illinois for employing an excluded individual who worked as a nurse and case manager when that individual was on the exclusions list.

HHS-OIG can exclude individuals and entities from federally funded healthcare programs such as Medicare and Medicaid for a variety of reasons. The length of time an individual or entity is excluded depends on the reason for exclusion, with the longest terms typically for Medicare and Medicaid fraud convictions. For example, a Michigan man was recently excluded for 10 years for submitting false claims for pharmaceuticals that were never dispensed. For repeat offenders, exclusion may be permanent.

For some offenses, there is no minimum exclusion period; for instance, HHS-OIG may exclude an entity for defaulting on its payment obligations under a settlement agreement. The entity will remain on the list at the discretion of HHS-OIG and will not be eligible for reinstatement until the default of their payment obligations is cured.

Healthcare organizations must check the HHS-OIG List of Excluded Individuals/Entities (LEIE) before any new hire or onboarding of a new vendor, and should also regularly check the LEIE to ensure that current employees and vendors are not excluded to avoid CMP liability.

The post HHS-OIG Imposes Penalties on Skilled Nursing Facilities for Employing Excluded Individuals appeared first on The HIPAA Journal.