Ruling in Medical Data Breach Case Details $1.3M Bitcoin Sale of Hacked Patient Information
On Tuesday, August 6, 2024, Pennsylvania federal judge Wendy Beetlestone issued a ruling in a data breach lawsuit against Prospect Medical Holdings Inc., dismissing two counts but allowing some claims to proceed.
Prospect Medical Holdings, a hospital operator, had argued that the plaintiffs lacked standing to bring the class action suit. However, Judge Beetlestone rejected this argument, finding that the plaintiffs satisfied the requirements for legal standing by demonstrating concrete injuries.
The judge cited costs related to emotional distress, therapy, time spent mitigating the effects of the breach, and intangible harms like the disclosure of private information. Each named plaintiff alleged injuries of this nature, according to the judge, making the risk of identity theft sufficiently concrete.
In August 2023, Prospect reported a cyberattack on its network in which a ransomware group called Rhysida stole sensitive information on patients. Compromised data included Social Security numbers, addresses, medical records, health insurance details, and more. Rhysida later posted victims’ information on the dark web and sold the full database for $1.3 million worth of bitcoin.
This prompted a nationwide class action lawsuit against Prospect. While Judge Beetlestone agreed the plaintiffs made valid negligence claims, she dismissed counts of breach of contract and invasion of privacy.
On the contract issue, the judge ruled the plaintiffs failed to demonstrate an explicit or implicit agreement that Prospect would safeguard their personal data. Additionally, the invasion of privacy claims under California and Pennsylvania law were rejected because the amended complaint did not allege Prospect itself intentionally intruded on information in which patients had a reasonable expectation of privacy.
Going forward, the lawsuit against Prospect can proceed on negligence grounds alone.
Please contact BlockTribune for access to a copy of this filing.
