A former employee of Microsoft subsidiary Nuance has pleaded guilty to a 2023 data breach involving over 1.2 million patient records at Danville, Pa.-based Geisinger.
Max Vance, 46, of California, agreed to the guilty plea Feb. 27 for one count of obtaining information from a protected computer without authorization, according to court records viewed by Becker’s. The judge in U.S. District Court for the Middle District of Pennsylvania ordered a presentence investigation.
Prosecutors alleged that Mr. Vance, after being fired by Nuance for unrelated reasons, used his Nuance credentials to log into Geisinger’s servers and download the data of more than 1.2 million of the health system’s patients onto his laptop. Geisinger and Microsoft settled a class-action lawsuit over the incident for $5 million.
The charge carries a maximum sentence of five years in prison and a $250,000 monetary penalty, though the plea agreement calls for time served followed by three years of supervised release and no fine.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.