The Georgia Supreme Court ruled Dec. 30 that patients involved in a June 2016 data breach at Athens (Ga.) Orthopedic Clinic can sue the medical center, according to The Atlanta Journal-Constitution.
The ruling overturned a verdict from the Georgia Court of Appeals that decided to throw out the case. The supreme court found that the 200,000 patients continue to face harm from the data breach.
In 2016, a cybercriminal group, known as the Dark Overlord, encrypted the computers at Athens Orthopedic Clinic. To unlock its systems, the hospital decided to pay the ransom. Patients were notified of the incident in August 2016.
Patients argue that the ransomware attack exposed their protected health information. One patient claimed that her information has been misused since the attack.
Attorneys for Athens Orthopedic Clinic and the plaintiffs did not respond to requests for comment from The Atlanta Journal-Constitution.