A settlement has been reached in a class action lawsuit against The Christ Hospital related to the alleged disclosure of protected health information.
Plaintiffs alleged that The Christ Hospital maintained web properties through which it encouraged patients to exchange communications to search for a doctor, learn more about their conditions and treatments, access medical records and test results, and make appointments. Plaintiffs alleged that through these web properties, The Christ Hospital caused unauthorized transmissions of protected health information to third parties, including Facebook and Google. The Christ Hospital denied this allegation, including specifically denying that any protected health information was shared with Facebook or Google and that any tracking tools or technologies were ever installed on its patient portal. However, because there are risks and legal uncertainty in any lawsuit, the parties collectively agreed to resolve their dispute on a class-wide basis.
The Settlement Class includes all Individuals who are or were patients of The Christ Hospital or any of its affiliates, used The Christ Hospital’s Patient Portal and/or Mobile App, and/or submitted a Health Risk Assessment, Appointment Request Form or Nurse Navigator Request Form between December 30, 2018 and January 13, 2023. The Christ Hospital has provided a list of individuals meeting this criteria. The individuals meeting this criteria are known as “Class Members.”
The Christ Hospital has agreed to establish a Settlement Fund of at least $4,500,000 with a maximum value of no more than $7,000,000. The exact amount of the Settlement Fund will depend on the number of Valid Claims that are submitted. The Settlement Fund will be used to pay for all fees, expenses, Service Awards, and Class Member benefits.
Class Members who submit a Valid Claim will receive a cash payment estimated to be at least $37.50 plus a one-year subscription to Privacy Shield Pro.
If you are a current or former patient of The Christ Hospital who used its Patient Portal, Mobile App, and/or submitted a Health Risk Assessment, Appointment Request Form or Nurse Navigator Request Form between December 30, 2018 and January 13, 2023, you could be eligible for a payment from the class action Settlement.
What Is Protected Health Information?
The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals’ privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights (“OCR”) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties.
The Privacy Rule protects all “individually identifiable health information” held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral. The Privacy Rule calls this information “protected health information (PHI).”
“Individually identifiable health information” is information, including demographic data, that relates to:
- the individual’s past, present or future physical or mental health or condition,
- the provision of health care to the individual, or
- the past, present, or future payment for the provision of health care to the individual,
and that identifies the individual or for which there is a reasonable basis to believe it can be used to identify the individual. Individually identifiable health information includes many common identifiers (e.g., name, address, birth date, Social Security Number).
The Privacy Rule excludes from protected health information employment records that a covered entity maintains in its capacity as an employer and education and certain other records subject to, or defined in, the Family Educational Rights and Privacy Act, 20 U.S.C. §1232g.
De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information. De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.
If you or a loved one may be the victim of a health care provider who disclosed your protected health information without your authorization or consent in the United States, you should promptly contact a local medical malpractice lawyer in your U.S. state who may investigate your unauthorized disclosure of protected health information claim for you and represent you or your loved one in a claim against the health care provider who disclosed your protected health information without your consent, if appropriate.
Click on the “Contact Us Now” tab to the right, visit our website, or call us toll-free in the United States at 800-295-3959 to find medical malpractice attorneys in your state who may assist you.
Turn to us when you don’t know where to turn.
