A proposed class action lawsuit was filed in the United States District Court for the Northern District of Ohio on December 20, 2023 against Salem Community Hospital and one of its medical vendors that alleges, in part, as follows:
Defendant Salem Community Hospital (“Salem”) is an independent, private, not-for-profit hospital located in Salem, Ohio.
Defendant Perry Johnson & Associated, Inc. (“PJ&A”) is a medical vendor which offers medical coding, transcription, and reporting services to medical providers. PJ&A provides transcription and dictation services to Salem. To perform this work, Salem provides PJ&A with certain Sensitive Information from its patients.
As part of their respective businesses, Defendants receive and maintain the Sensitive Information of thousands of consumers. In doing so, Defendants implicitly promise to safeguard their Sensitive Information. In collecting and maintaining consumers’ Sensitive Information, Defendants agree to safeguard the data in accordance with state and federal law.
This Class Action arises from a breach of sensitive information in the possession and custody and/or control of one or both Defendants (the “Data Breach”). The Data Breach resulted in the unauthorized disclosure, exfiltration, and theft of consumers’ highly personal information, including names, Social Security numbers, dates of birth, addresses, and phone numbers (“personal identifying information” or “PII”), as well as medical record number, hospital account number, and dates of service (“protected health information” or “PHI”). Plaintiffs refer to both PII and PHI collectively as “Sensitive Information.”
According to a letter received by Plaintiffs from Defendants, the Data Breach occurred between March 27, 2023, and May 2, 2023. Defendants advise they became aware of the Data Breach on May 2, 2023. Accordingly, cybercriminals had unrestricted and unrestrained access to Plaintiffs’ and the Class’s highly private Sensitive Information for perhaps as much as five weeks. Discovery may reveal that this occurred for a longer period of time.
Defendants sent Plaintiffs a letter on November 10, 2023 (“Notice Letter”) to inform them of the Data Breach. Thus, Defendants inexplicably waited six months before informing Class Members of the Data Breach, even though Plaintiffs and the Class Members had their most sensitive personal information accessed, exfiltrated, and stolen, causing them to suffer ascertainable losses in the form of the loss of the benefit of their bargain and the value of their time reasonably incurred to remedy or mitigate the effects of the attack.
Defendants’ Breach Notice failed to tell their consumers how many people were impacted, how the breach happened, or why it took Defendants months to begin notifying victims that hackers had gained access to highly private Sensitive Information.
News reporting indicates that approximately 9 million individuals were impacted by the Data Breach.
Defendants’ failure to timely detect and report the Data Breach made their consumers vulnerable to identity theft without any warnings to monitor their financial accounts or credit reports to prevent unauthorized use of their Sensitive Information.
Defendants knew or should have known that each victim of the Data Breach deserved prompt and efficient notice of the Data Breach and assistance in mitigating the effects of PII and PHI misuse.
In failing to adequately protect Plaintiffs’ and the Class’s Sensitive Information, failing to timely and adequately notify them about the breach, and by obfuscating the nature of the breach, Defendants violated state and federal law and harmed an unknown number of their consumers.
Plaintiffs and members of the proposed Class are victims of Defendants’ negligence and inadequate cyber security measures and have been damaged as detailed herein.
Accordingly, Plaintiffs, individually and on behalf of a class of similarly situated individuals, bring this lawsuit seeking injunctive relief, damages, and restitution, together with costs and reasonable attorneys’ fees, the calculation of which will be based on information in Defendants’ possession.
Stone v. Salem Community Hospital, Case: 4:23-cv-02421.
If you or a loved one may have been harmed as a result of unlawful disclosure of protected health information, a data breach, or a HIPAA violation in the United States, you should promptly find a medical malpractice lawyer in your state who may investigate your HIPAA violation claim for you and represent you or your loved one in a HIPAA violation case, if appropriate.
Click here to visit our website or call us toll-free in the United States at 800-295-3959 to find medical malpractice attorneys in your U.S. state who may assist you.
Turn to us when you don’t know where to turn.