Prospect Medical Holdings Data Breach Lawsuit Survives Motion to Dismiss
A lawsuit filed against Prospect Medical Holdings over a Summer 2023 Rhysida ransomware attack has survived a motion to dismiss; however, some of the asserted claims have been dismissed. Prospect Medical Holdings detected unauthorized access to its network in early August 2023 and the investigation confirmed that an unauthorized third party had access to its network for around four days prior to the discovery of the intrusion. The review of the compromised systems confirmed they contained names, dates of birth, Social Security numbers, driver’s license numbers, financial information, diagnoses, lab test results, treatment information, medical record numbers, health insurance information, and claims information.
The Rhysida ransomware group claimed responsibility for the attack and said it stole a database that contained more than 1 TB of customers’ personally identifiable information (PII) and protected health information (PHI), including more than half a million Social Security numbers. When ransoms are not paid, Rhysida is known to sell the stolen data or publish it on its data leak site, and in this attack it did both, claiming around half of the data had been sold and the other half was listed.
Prospect Medical Holdings offered the affected individuals free credit monitoring and identity theft protection services and implemented new administrative and technical safeguards. The breach was reported to the HHS’ Office for Civil Rights as affecting 1,309,096 individuals. Several lawsuits were filed in response to the breach, and an amended lawsuit has been brought that names several plaintiffs and represents a nationwide class of individuals affected by the data breach. The plaintiffs allege they have been harmed to varying degrees and six of the plaintiffs allege they have seen evidence of attempted fraudulent transactions using their personal information.
The lawsuit asserted claims of negligence, negligence per se, violation of the Federal Trade Commission Act, breach of implied contract, and violations of the California Confidentiality of Medical Information Act (CMIA), California Unfair Competition Act, and the California Constitution. The lawsuit seeks damages and injunctive relief. Prospect Medical Holdings filed a motion to dismiss the amended lawsuit alleging none of the named plaintiffs had standing and none had plausibly argued that they were entitled to any relief under any of the common-law or statutory claims included in the complaint.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The motion to dismiss the lawsuit for lack of standing was dismissed by District Court Judge Wendy Beetlestone, as all of the named plaintiffs plausibly alleged cognizable concrete and imminent injuries. The motion to dismiss the lawsuit for the plaintiffs not plausibly alleging they are entitled to relief was granted for some of the claims, but not others. The motion to dismiss the negligence claim was denied, as the plaintiffs had plausibly alleged that they had suffered cognizable tort damages and sufficiently alleged causation. The motion to dismiss the negligence per se claim and violation of the FTC Act was granted; however, the judge allowed the plaintiffs to press it as a theory to support their negligence claim and said they may rely on the alleged violation of the FTC Act in doing so.
The breach of implied contract claim was dismissed without prejudice as the plaintiffs failed to plausibly plead the existence of an implied contract between them and Prospect Medical Holdings. The claims of common law privacy and violation of the California Constitution were dismissed with prejudice as the complaint does not allege intentional conduct by Prospect Medical Holdings, and the violation of the California Unfair Competition Law claim was dismissed without prejudice, with the plaintiffs allowed to plead that they lack an adequate remedy at law. Finally, the motion to dismiss the violation of the CMIA claim was denied, as the Rhysida gang claimed that patient files were for sale on the dark web and it was plausible to infer that those files contained medical histories.
