NCH Healthcare System Hit with Class Action Lawsuit Over June 2019 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

NCH Healthcare System, Inc. has been hit with a proposed class action over a data breach that reportedly exposed the personal and medical information of over 63,000 patients.

The defendant, an alliance of over 700 independent physicians and healthcare facilities in southwest Florida and Collier County, allegedly became aware in June 2019 of suspicious activity within its human resources, timekeeping, and payroll system. After launching an investigation, NCH reportedly discovered that several employees had fallen victim to a phishing scheme that the case says allowed unauthorized parties to gain access to payroll records and email accounts that contained patients’ unencrypted personal and medical information. 

Among the information allegedly accessed in the breach were patient names, dates of birth, Social Security and driver’s license numbers, tribal identification numbers, financial account and payment card details, medical and treatment histories, medication or prescription data, beneficiary and provider information, patient identification numbers, health insurance records, usernames, passwords, and other protected health data.

The lawsuit claims NCH maintained patients’ data in a “reckless manner” particularly vulnerable to cyberattacks. Not only was the data stored in computer systems “in dire need of security upgrading,” but the defendant failed to encrypt patients’ information, implement procedures for handling nefarious emails, and properly train employees on how to spot and report suspicious communications, the case says.

Moreover, the complaint asserts the defendant failed to provide victims timely notice of the data breach and instead waited until February 14, 2020, nearly eight months after the incident was discovered, to notify affected patients.

According to the lawsuit, the defendant’s failure to take steps to protect sensitive data has exposed patients to a heightened risk of identity theft and fraud. In addition to shouldering out-of-pocket costs associated with monitoring their credit and mitigating the risks caused by the breach, proposed class members have suffered emotional damages as well, the case says. From the complaint:

To date, the suit says, NCH has done “absolutely nothing” to provide relief to those affected by the 2019 data breach.

The lawsuit, which has been removed to Florida district court, alleges violations of state law, negligence, breach of contract, intrusion upon seclusion/invasion of privacy, unjust enrichment, breach of confidence, and breach of fiduciary duty.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s newsletter here.