CHARLESTON – A potential class-action lawsuit has been filed against Charleston Area Medical Center related to a data breach by one of its employees.
The named plaintiff, identified only as K.J.P., filed the complaint in Kanawha Circuit Court against CAMC.
According to the complaint, the case arises out of “personal and sensitive medical information being access by an employee of the defendant who did not have a business need to do so.”
Giatras
Attorney Troy Giatras, who is representing the plaintiff, said he isn’t sure just how many people could be involved in this class action, but he suspects its around 40 or so patients.
“Privacy of medical records and sensitive information has never been more important,” Giatras told The West Virginia Record. “My firm is on the frontlines every day protecting the privacy of West Virginians when unfair breaches of private information occur.
“This was a case where CAMC left our client’s medical information in a vulnerable and exposed manner to be viewed for a non-business purpose and a non-authorized purpose. It wasn’t for medical treatment. Surprisingly, this happens very frequently."
Because this incident didn't involve more than 500 individuals, Giatras said CAMC wasn't required to post about the data breach online. Letters were sent to those affected.
“You get people wanting to be nosy, and the systems in place don’t lock down the medical records and information for current and past patients," Giatras said. "At the end of the day, it’s cheaper for companies to worry about getting caught rather than to implement a system-wide program.
“These types of things happen regularly, probably on a daily basis around the country and even in the state of West Virginia. There is too much unfettered, unauthorized access to medical records.”
In this case, the plaintiff says he received a letter from CAMC on November 8 saying an employee accessed his “medical records without a business need.” The employee accessed medical and sensitive personal information, such as full name, Social Security number, date of birth, home address, account number, sensitive medical diagnoses, private treatment information and other legally protected information.
“It is apparent that the defendant failed to monitor its employees’ conduct and any systems it has in place to safeguard K.J.P. and the putative class members’ personal sensitive information entrusted to it for protection,” the complaint states.
The complaint accuses CAMC of a breach of the duty of confidentiality, unjust enrichment, prima facia negligence, breach of contract, negligent supervision and negligence.
K.J.P. and the other potential class members will seek an order providing consumer credit protection and monitoring services, maintenance of consumer credit insurance to provide coverage for unauthorized use of the plaintiffs’ personal information, relief requesting that CAMC establish a specific device encryption security program to protect against such actions again.
The plaintiffs also will seek compensatory damages, punitive damages, interest, attorney fees, court costs and restitution.
The plaintiffs are being represented by Giatras and Matthew Stonestreet of The Giatras Law Firm in Charleston as well as by William Pepper and Daniel T. Lattanzi of Pepper & Nason in Charleston. The case has been assigned to Circuit Judge Maryclaire Akers.
Kanawha Circuit Court case number 21-C-1136