Concentra Facing Class Action Over 2023 Data Breach Affecting 4 Million Patients

New to ClassAction.org? Read our Newswire Disclaimer

Concentra Health Services faces a proposed class action after it fell victim to a data breach that reportedly exposed the private information of almost four million patients in 2023.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 51-page data breach lawsuit, Perry Johnson & Associates (PJ&A), a third-party vendor that provides medical transcription services for Concentra, discovered in May 2023 that cybercriminals had gained access to its computer systems. After launching an investigation, PJ&A learned the unauthorized actor had hacked a system that contained information about Concentra’s patients on April 7 and April 19, 2023, the case says.

The complaint claims the Concentra data breach compromised consumers’ names, dates of birth, addresses, Social Security numbers, insurance and clinical information, medical record numbers, hospital account numbers, admission diagnoses, and dates and times of service.

Per the suit, Concentra, parent company Select Medical Holdings Corporation and PJ&A were obligated under HIPAA, industry standards and contractual promises to protect patients’ data from unauthorized access by following appropriate cybersecurity protocols. However, the complaint contends, the defendants “willfully, recklessly, or negligently” failed to properly secure and encrypt the sensitive information in their care.

“[The defendants’] data security obligations were particularly important given the substantial increase in cyberattacks and/or data breaches in the healthcare industry preceding the date of the breach,” the lawsuit notes.

The filing argues that affected individuals now have to deal with a substantially increased risk of identity theft and fraud.

To add insult to injury, “[the defendants’] failure to promptly notify [the plaintiff] and class members that their private information was accessed and stolen allowed cybercriminals to monetize, misuse, or disseminate that private information before [the plaintiff] and class members could take affirmative steps to protect their sensitive information,” the case charges.

The complaint says PJ&A waited to inform Concentra about its involvement in the incident until November 2023, more than six months after the vendor first became aware of the breach. It wasn’t until February 8, 2024 that the defendants began sending notice letters to Concentra data breach victims, the filing relays.

The lawsuit looks to represent anyone whose personal information was accessed, compromised, copied, stolen and/or revealed as a result of the data breach affecting Concentra.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.