A Florida patient has filed a class-action lawsuit against UF Health Central Florida (UFHCF) after a data breach exposed the personal information of more than 700,000 people.
According to a complaint to the U.S. District Court for the Middle District of Florida filed on Oct. 14, Chrystal Holmes, a Lake County resident, is suing The Villages Tri-County Medical Center, UF Health Central Florida and Leesburg Regional Medical Center Inc. after a May cyber attack exposed the data of 700,981 patients. According to a report to the U.S. Department of Health and Human Services’ Office of Civil Rights, hackers gained unauthorized access to UFHCF’s computer network around May 31, gaining sensitive patient information – including names, addresses, dates of birth, Social Security numbers, health insurance information, medical record numbers and patient account numbers.
In the lawsuit, currently seeking class-action status, Holmes cited that UFHCF failed to keep patients’ data safe. The lawsuit also accuses the health system of retaining protected health information beyond the required time frame, which made sensitive data more vulnerable to attacks.
“Despite the prevalence of public announcements of data breach and data security compromises, UFHCF failed to take appropriate steps to protect the PII and PHI of [the] plaintiff and the proposed class from being compromised,” the court documents read, according to Healthcare IT News.
The data breach also resulted in UFHCF’s IT systems going down for nearly a month, during which the health system was forced to switch to paper documentation. UFHCF noted it brought the electronic health record (EHR) back online June 25.
“Until notified of the breach,” Holmes and the other affected people in the proposed class “had no idea their PII and PHI had been compromised, and that they were, and continue to be, at significant risk of identity theft and various other forms of personal, social and financial harm,” the complaint added.
“The risk will remain for their respective lifetimes,” it continued.