Cleveland-based University Hospitals is facing a proposed class-action lawsuit alleging it failed to protect patient information during an October cybersecurity incident that disrupted its MyChart patient portal and other digital services.
The lawsuit, filed Oct. 28 in the U.S. District Court for the Northern District of Ohio, alleges that sensitive patient information was stolen during the incident. The complaint alleges, without citing a source, that the incident affected more than 1 million current and former patients, though it elsewhere describes the number of affected patients as hundreds of thousands. University Hospitals has not publicly confirmed that patient data was compromised or disclosed how many individuals may have been affected.
The complaint was filed by Tanya Darden, a current University Hospitals patient from Cleveland, who alleges the health system failed to implement adequate cybersecurity measures to protect patients’ personal and medical information.
According to the lawsuit, the potentially compromised information includes names, Social Security numbers, dates of birth, addresses, health insurance information, medication information and treatment information.
Ms. Darden alleges that following the incident, she began receiving spam calls from callers who identified her by name and asked her to verify personal information, including her date of birth, Social Security number and address. She also alleges she was notified Oct. 26 of an unauthorized request to access her credit report.
The lawsuit alleges University Hospitals failed to adequately safeguard patient data, train employees on cybersecurity and implement industry-standard security measures, including multifactor authentication. It also claims the health system had not begun notifying affected individuals about the alleged data breach when the complaint was filed.
The complaint includes claims of negligence, breach of implied contract, unjust enrichment and breach of fiduciary duty. It seeks class-action status, a jury trial, damages and injunctive relief.
The allegations have not been proven in court.
The lawsuit follows an ongoing cybersecurity incident that came to light Oct. 22, when University Hospitals detected unusual activity on its servers and disconnected its systems from the internet as a precaution.
The health system subsequently rescheduled some appointments and elective procedures and reported challenges with network connectivity and insurance preauthorizations. Its MyChart patient portal has remained unavailable.
In an Oct. 28 update, University Hospitals said the vast majority of appointments and procedures were continuing as normal despite the disruptions. The health system said it was working to restore MyChart access and advised patients to attend scheduled appointments unless contacted by their care teams.
University Hospitals has said it is investigating the incident with outside experts and is communicating with law enforcement. The health system has not disclosed the cause or full scope of the incident.
A spokesperson for University Hospitals told Becker’s it does not comment on pending litigation.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
