One Brooklyn Well being Sued over 235K-File Knowledge Breach

Posted By HIPAA Journal on Could 1, 2023

One Brooklyn Well being, a New York Metropolis-based community of three acute care hospitals – Brookdale Hospital Medical Middle, Interfaith Medical Middle, and Kingsbrook Jewish Medical Middle – is going through a category motion lawsuit over an information breach that was found in November 2022.

On November 19, 2022, One Brooklyn Well being recognized suspicious exercise inside its pc community. The community was instantly secured, and the forensic investigation confirmed that an unauthorized third get together had intermittently accessed its community between July 9, 2022, and November 19, 2022. The doc assessment took till March 21, 2023, and notification letters have been despatched on April 20, 2023. The knowledge uncovered and doubtlessly stolen within the assault included names, dates of start, billing and claims information, therapy particulars, medical document numbers, prescriptions, medical insurance info, and Social Safety numbers. Greater than 235,000 sufferers have been affected.

On April 26, 2023, a lawsuit was filed within the Supreme Court docket of the State of New York, County of Kings, on behalf of plaintiff Kiya Johnson and equally located people by the legislation corporations Wittels McInturff Palikovic and Shub & Johns LLC. The lawsuit alleges One Brooklyn Well being knew that it saved delicate affected person info and that it was a goal for cybercriminals and that it was obligated underneath the Well being Insurance coverage Portability and Accountability Act to guard that information but didn’t implement affordable and acceptable safety measures thus permitting unauthorized people to entry its community and steal affected person information.

The lawsuit alleges the plaintiff and sophistication members have needed to spend appreciable money and time defending themselves in opposition to misuse of their protected well being info and that they’ve and can proceed to undergo hurt and have been positioned at an imminent, rapid, and persevering with danger of id theft and fraud. The lawsuit states 8 causes of motion: negligence (plaintiff and sophistication), negligence per se, breach of fiduciary responsibility, breach of confidence, intrusion upon seclusion/invasion of privateness, breach of implied contract, unjust enrichment, and violations of New York Basic Enterprise Legislation.

The lawsuit seeks class motion standing, a jury trial, damages, restitution, and injunctive reduction, with the latter together with enhancements to information safety practices.