Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit

Posted by Steve Alder

Jefferson County Health Department, a public health agency for Jefferson County in Hillsboro, Missouri, has agreed to settle class action litigation that was initiated in response to a 2022 data security incident.

The incident that sparked the litigation was identified on or around November 15, 2022. The forensic investigation determined that its network was accessed by an unauthorized third party between October 31 and November 15, 2022, who potentially viewed or obtained personal and protected health information such as names, dates of birth, Social Security numbers, driver’s license numbers, financial account information, medical information, and health insurance information. The data breach was reported to the HHS’ Office for Civil Rights on January 13, 2023, as involving the protected health information of 115,940 individuals.

The first class action lawsuit was filed on January 27, 2023, and was consolidated with a second complaint on October 2, 2023. The consolidated lawsuit – J.D., et al. v. Jefferson County Health Center d/b/a Jefferson County Health Department – is pending in the Circuit Court of the City of St. Louis, State of Missouri.

The consolidated lawsuit alleged that the plaintiffs would not have sought healthcare services from Jefferson County Health Center if they knew that their personal and health information would not be adequately protected. They claim that the failure to implement appropriate cybersecurity measures constituted negligence, breach of contract, breach of fiduciary duty, and violated the covenant of good faith and fair dealing. Jefferson County Health Department maintains that there was no wrongdoing and does not believe there is any liability or that there were any damages. A motion to dismiss the lawsuit was denied by the court, and a settlement was ultimately negotiated that was acceptable to all parties and avoids the cost and risks associated with a trial and related appeals.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Under the terms of the settlement, Jefferson County Health Department has agreed to establish a $2.25 million settlement fund, from which attorneys’ fees and expenses, settlement administration costs, and service awards for the three class representatives will be deducted. The remainder of the fund will be used to pay for benefits to the class members.

Class members may either submit a claim for reimbursement of documented, unreimbursed losses due to the data breach up to a maximum of $300 per class member, including up to three hours of lost time at $20 per hour. Individuals who do not submit a claim for reimbursement of losses and lost time may claim a one-time cash payment of $150. The deadline for exclusion from the settlement, objection, and submitting a claim is November 16, 2026. The final fairness hearing has been scheduled for December 10, 2026.

The post Jefferson County Health Department Pays $2.25M to Settle Data Breach Lawsuit appeared first on The HIPAA Journal.

HHS Sends Letters of Nonconformity to Suspected Information Blockers

Posted by Steve Alder

The U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health IT (ONC) has sent warning letters to seven health IT companies suspected of engaging in information blocking, in violation of the information blocking rules of the 21st Century Cures Act. The recipients of the letters of nonconformity have not been named, as the HHS declines to make such information public when there are active investigations; however, the companies will be named if there are any corrective actions, financial penalties, suspensions, or terminations due to noncompliance.

In September last year, the HHS announced that it would be actively enforcing compliance with the information blocking regulations and would take action against any entity that blocks patients, providers, or other entities from legally obtaining access to health information. The maximum penalty for an information blocking violation is $1 million per violation; however, no penalties for information blocking have been imposed to date, and there have been no suspensions or terminations.

At the annual ADAPT conference on October 15, Thomas Keane, HHS National Coordinator for Health IT, said most of the recipients of the letters of nonconformity have responded by remediating the allegations of restricted data access and have agreed to change their data sharing practices. Keane said his office is keen to work with health IT companies to ensure that they understand the requirements but will adopt an enforcement stance if data sharing practices are not voluntarily changed.

Keane confirmed that ONC is working with the Justice Department, HHS Office of Inspector General, and the Federal Trade Commission to enforce the information blocking regulations. Amy Gleason, administrator of the U.S. DOGE Service and Chief Product Officer at the Centers for Medicare and Medicaid Services (CMS), said the CMS is taking troubleshooting calls to help get patient data flowing, stating that there have only been two such calls to date.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

The post HHS Sends Letters of Nonconformity to Suspected Information Blockers appeared first on The HIPAA Journal.