Oct. 04–Stanford Hospital & Clinics vowed Monday to “vigorously defend”
itself against a $20-million class-action complaint filed in the wake of a data
breach that saw the medical records of 20,000 patients posted on a commercial
website for nearly a year.
Shana Springer filed the complaint on Sept. 28 in Los Angeles County Superior
Court, on behalf of fellow patients treated in Stanford’s emergency room between
March 1, 2009, and Aug. 31, 2009. She is seeking $1,000 per patient, as well as
other penalties, damages and attorneys fees.
The nine-page complaint alleges the hospital violated the Confidentiality of
Medical Information Act, a state law that requires medical providers to
safeguard patient information and prohibits its disclosure without written
consent.
“On its website, Stanford claims that its patients’ ‘health care experience
is [its] highest priority.’ Thus, it should be no surprise that when patients
are treated at Stanford’s facilities, they expect that their private medical
information will be kept confidential and will not be disclosed to anyone
without their authorization,” the complaint states.
In a brief statement released Monday, Stanford placed the blame on complaint
codefendant Multi-Specialty Collection Services LLC, saying it was the
subcontractor that mishandled the data. The hospital has since cut ties with the
Woodland Hills-based company, which provided collection and billing
services.
“(Stanford Hospital & Clinics) intends to vigorously defend the lawsuit
that has been filed as it acted appropriately and did not violate the law as
claimed in the lawsuit,” the statement said.
According to the complaint, Multi-Specialty Collection Services was “in part
responsible for the unlawful disclosure of the private medical information of
Plaintiff and class members.”
Stanford confirmed the data breach on Sept. 8. The released information
included medical record numbers, hospital account numbers, billing charges, and
emergency room admission and discharge dates. It also revealed a Santa Clara
man’s psychiatric diagnosis.
Credit card and Social Security numbers were not included.
According to its statement, the hospital properly sent the data to
Multi-Specialty Collection Services in an encrypted format to protect its
confidentiality. The company produced an electronic spreadsheet, which it
allegedly sent to a third party for help creating a graph to display the data.
That third party then posted the information on a public website, Stanford
said.
Springer’s complaint identified the website as Student of Fortune, which
solicits bids to answer homework questions. The data first appeared online in
early September 2009. The identity of the person who uploaded the information
was not disclosed in either the complaint or the statement.
“This mishandling of private patient information was in complete
contravention of the law and of the requirements of (Multi-Specialty Collection
Service’s) contract with (Stanford Hospital & Clinics) and is shockingly
irresponsible,” Stanford said in its statement.
However, no identity theft cases have been reported as a result of the data
breach, which went unnoticed for nearly a year, according to the hospital.
“To date there is no evidence that anyone saw this information on the website
and improperly used it for fraudulent or any other improper purpose,” the
statement said. “(Stanford Hospital & Clinics) has investigated this matter,
terminated its relationship with (Multi-Specialty Collection Service), and
reported this breach to law enforcement authorities.”
The hospital reiterated Monday that it moved quickly to have the sensitive
information pulled from the website once it became aware of the data breach,
notified the affected patients and provided free identity protection
services.
Multi-Specialty Collection Services representatives could not be reached for
comment late Monday afternoon.
Los Angeles-based lawyers Brian S. Kabateck, Richard L. Kellner, Karen Liao,
Byron T. Ball and Bradley I. Kramer are representing Springer and the proposed
class.
Email Jason Green at jgreen@dailynewsgroup.com.
___
(c)2011 the Palo Alto Daily News (Menlo Park, Calif.)
Visit the Palo Alto Daily News (Menlo Park, Calif.) at www.paloaltodailynews.com
Distributed by MCT Information Services |
Adjmediator's Blog 