Following a data breach of the nationwide cancer center, 21st Century Oncology, patients filed multiple class action lawsuits against the provider alleging that 21st Century failed to establish adequate cybersecurity measures in violation of federal and state law. Although the breach impacted an alleged 2.2 million patient records, the provider notified patients that it does not believe medical records were accessed or information was misused as a result of the breach. One of the class action complaints condemns the provider’s lack of control over protected health information (PHI), saying, “the last thing patients dealing with potentially deadly illnesses need is further harm and stress caused by the insecurity of their most private data and how it may be used by thieves.”
In a complaint filed on March 23, 2016, several patients alleged that the provider was not aware that it had been infiltrated until notified of the breach by the FBI. Although investigators informed the provider of the breach on November 12, 2016, 21st Century announced it was instructed not to inform patients until this month. The lawsuits allege that data stolen by thieves includes patients’ names, Social Security numbers, physicians’ names, medical diagnoses, treatment information, and insurance information. One lawsuit asserted that the content of the 2.2 million current and former patients may have been copied and transferred as a result of the breach. The complaints allege that the provider violated the Health Information Portability and Accountability Act (HIPAA) (P.L. 104-191) and industry data protocols, was negligent in its safeguarding of PHI, was in breach of the implied covenant of good faith and fair dealing, and, in some cases, violated state consumer protection laws.
One lawsuit alleges that 21st Century is not a stranger to data breaches. Specifically, the complaint alleged that between October 11, 2011 and August 8, 2012, a 21st Century employee provided PHI to a third party who used the information—names, Social Security numbers, and dates of birth—to file fraudulent tax refunds. The complaint alleged that 21st Century also failed to detect the earlier breach.
According to 21st Century’s announcement on the more recent breach, the provider is notifying affected patients and offering them free one-year credit protection services. Some of the lawsuits acknowledge the provider’s offer and call it inadequate, suggesting that the threat and harm resulting from the breach is more serious than the compensation reflects and will last longer than a year. The lawsuits follow a settlement earlier this month, where 21st Century agreed to pay $34.7 million to settle claims that it billed Medicare and Tricare for medically unnecessary radiation tests between 2009 and 2015.