[BreachExchange] Lurie Children’s Hospital hit with lawsuit over patient data breaches

[Destry Winant]

https://www.chicagotribune.com/business/ct-biz-lurie-childrens-hospital-privacy-breach-lawsuit-20200508-atoyzonpizeirhuqzti4beg65e-story.html

An Illinois mother and her 4-year-old child have filed suit against
Ann & Robert H. Lurie Children’s Hospital of Chicago and two unnamed
employees, alleging the hospital failed to keep the daughter’s medical
records safe.

The lawsuit, filed in the Circuit Court of Cook County Friday, alleges
breach of contract, breach of confidentiality, negligent supervision
and other counts against Lurie Children’s Hospital. The lawsuit, which
seeks class-action status, asks for a jury trial.

Jane Doe and her child Baby Doe, both pseudonyms to protect the
patient’s identity, brought the lawsuit after the family was notified
by the hospital about two incidents in which Lurie employees accessed
Baby Doe’s medical records without permission, the suit alleges.

On Dec. 24, the hospital sent a letter to Jane Doe telling her that an
unnamed nursing assistant gained access to her child’s medical records
without authorization between September 2018 and September 2019,
according to the suit.


The mother had taken her child, who was 3 at the time, to Lurie in
early 2019 for an examination because she suspected her daughter had
been sexually abused, the suit says.

[Most read] Coronavirus in Illinois updates: Here’s what’s happening
Friday with COVID-19 in the Chicago area »

The breach of Baby Doe’s records was part of a broader data breach at
Lurie that included other patient records, the suit alleges. Patients’
names, addresses, dates of birth, and medical information like
diagnosis, medications, appointments and procedures were accessed.

Lurie said at the time that it fired that worker after a thorough
investigation, and that it had no reason to believe the worker misused
or released patients’ information.

On Monday, Lurie notified the family of another data breach. The
patient’s medical records were accessed without authorization by
another unnamed hospital worker between Nov. 1, 2018 and Feb. 29,
2020, the suit alleges.

The lawsuit alleges that Lurie did not say what protocols would be put
in place to ensure the security of the patient’s medical records, nor
did the hospital identify the worker.

The hospital has not seen the lawsuit, Lurie spokeswoman Julie Pesch
said in a statement.

“In December 2019 and May 2020, Lurie Children’s notified some of our
patients about two nurse assistants who had accessed certain patients’
medical records without an identified patient need. We have no reason
to suspect any misuse of patient information associated with this
incident. Lurie Children’s addressed this issue in accordance with our
disciplinary policies, and the employees no longer work for the
Hospital,” Pesch said in an emailed statement.

In addition to unspecified damages, the suit seeks credit monitoring
to protect against identity theft, said Jay Edelson, who is
representing the family and estimated more than 8,000 patients could
join the class.