Patients Sue Hospital After Breach
Five of about 3,655 patients whose protected health information at Charleston Area Medical Center in West Virginia was breached last September have filed a lawsuit seeking class action status for all affected patients.
The suit, Tabata v. Charleston Area Medical Center, was filed in Circuit Court in Kanawha County. The Charleston law firm of Meyer, Ford, Glasser and Radman PLLC is representing the plaintiffs.
The hospital on Feb. 16, 2011, issued a public notice of the breach, only eight days after becoming aware of it. A third party in September 2010 constructed a database containing affected patients' names, demographic information, Social Security numbers and medical information. The database was designed to help the hospital better manage patients in outpatient settings to reduce unnecessary hospitalizations. A security flaw in the database was not known for several months until a relative of one of the plaintiffs found the confidential records during an Internet search, according to the suit.
In its notification letter to affected patients, Charleston Area Medical Center offered on year of paid credit monitoring services from Equifax, and also offered to pay for patients to apply a security freeze at all three national credit bureaus.
The lawsuit alleges four counts against the hospital: breach of the duty of confidentiality, invasion of privacy by intrusion upon the seclusion of the plaintiffs, invasion of privacy by unreasonable publicity into the plaintiffs' private life, and negligence.
The plaintiffs ask the court to certify the suit as a class action, require the hospital to establishment a specific security program, award monetary damages to provide adequate credit and identity protection and monitoring services for "an extended period of years," award damages for the lack of security and loss of privacy, and award damages for annoyance, embarrassment and emotional distress plaintiffs have suffered,
A hospital spokesperson did not respond to a request for comment. For a copy of the lawsuit, send e-mail to firstname.lastname@example.org.