Lawsuits Mounting Against Florida Hospital in Wake of Breach

Tampa General Hospital is facing at least three proposed federal class action lawsuits filed in recent days following the nonprofit Florida healthcare provider’s disclosure late last month of a data theft incident that affected 1.3 million patients and employees.

See Also: Live Webinar | Unmasking Pegasus: Understand the Threat & Strengthen Your Digital Defense

Each lawsuit was filed in the U.S. District Court for the Middle District of Florida within the last week. The most recent filing was on Tuesday. All of the lawsuits make similar allegations, including that Florida Health Sciences Center Inc. – which does business as Tampa General Hospital – was negligent in failing to secure patients’ sensitive health and personal identifiable information from unauthorized access by cybercriminals.

“As a result of the data breach, plaintiff and class members have been and will continue to be at a heightened and substantial risk of future identity theft and its attendant damages for years to come,” alleges the lawsuit complaint filed Tuesday by lead plaintiff Louis Ruggiero – a Tampa General Hospital patient – on behalf of himself and all others similarly situated.

“Such risk is certainly real and impending and is not speculative given the highly sensitive nature of the PII compromised by the data breach,” Ruggiero’s lawsuit says.

TGH is one of Florida’s largest hospitals, serving a dozen counties with a population of more than 4 million people. The hospital’s website says the facility is licensed for 1,040 beds, and has a workforce of more than 8,000 people, making it one of the region’s largest employers.

The hospital on July 19 announced that it had begun notifying 1.2 million patients and employees affected by the incident. But TGH’s breach report, which was posted on Wednesday to the Department of Health and Human Services’ HIPAA Breach Reporting Tool website, shows the incident affected more than 1.3 million individuals.

TGH said it had detected unusual activity on its systems on May 31 and had thwarted an attempt by attackers to encrypt the organization’s IT systems. Despite TGH stopping the ransomware encryption, its investigation into the incident determined that certain files from the hospital’s systems had been accessed and obtained by attackers over three weeks, between May 12 and May 30.

Information contained in the compromised files varied by individual, but includes names, addresses, phone numbers, birthdates, Social Security numbers, health insurance information, medical record numbers, patient account numbers, dates of service, and certain treatment information used by TGH for its business operations.

The hospital said its electronic medical records system had not been compromised in the incident.

TGH “did not use reasonable security procedures and practices appropriate to the nature of the sensitive information they were maintaining for plaintiff and class members, such as encrypting the information or deleting it when it is no longer needed, causing the exposure of private information,” alleges the lawsuit complaint filed Monday by lead plaintiff Zoie Russo on behalf of herself and other similarly affected individuals.

Russo’s lawsuit, like the other two proposed class actions so far, is seeking monetary damages as well as injunctive relief, including an order for TGH to improve its security practices.

That includes requiring TGH to encrypt all data collected through the course of its business in accordance with applicable regulations, industry standards, and federal, state or local laws; deleting, destroying and purging the private information of individuals, unless TGH can give the court reasonable justification for the retention and use of the information; and implementing and maintaining a comprehensive information security program.

TGH did not immediately respond to Information Security Media Group’s request for comment on the lawsuits and their allegations.

Earlier Breach Litigation

The string of recent proposed class action lawsuits against TGH is not the first time the healthcare entity has faced litigation in the aftermath of a data breach.

In December 2016, TGH agreed to pay a total of $10,000 to plaintiffs who alleged they had been at risk for identity theft as a result of a series of insider incidents at the organization over several years that compromised the personal information of nearly 1,200 individuals (see: Settlement in Tampa General Hospital Insider Breach Lawsuit).

While the monetary amount of that TGH settlement was small, the agreement was noteworthy because very few breach-related class action lawsuits at that point had been settled for any amount. Settlement agreements were rare, and most health data breach cases at the time were still being dismissed by courts due to a lack of evidence showing specific harm to affected individuals.