MEDICAL FOUNDATION, a California Corporation; SUTTER HEALTH, a California

Transcription

1

2 Plaintiff DOROTHY ATKINS ( Plaintiff ) brings this action against Defendants SUTTER MEDICAL FOUNDATION, a California Corporation; SUTTER HEALTH, a California Corporation; SUTTER PHYSICIAN SERVICES, a California business entity (collectively, Defendants or SUTTER ), and DOES 1-0 on behalf of herself and all others similarly situated. Plaintiff makes the following allegations upon information and belief, except as to her own actions, the investigation of her counsel, and the facts that are a matter of public record: PRELIMINARY STATEMENT 1. This is a consumer class action lawsuit brought on behalf of Plaintiff, individually, and on behalf of all other persons whose identities, personal information, financial information, and medical information were lost or disclosed by Defendants in or around October 0.. Defendants failed to keep safe their customers sensitive private information, and to promptly notify their customers of the data breach. As alleged in more detail below, on or about November, 0, Defendants announced, through a post on their website, that During the weekend of Oct. -, 0 a month before the posting a password-protected unencrypted desktop computer was stolen from Sutter Medical Foundation s administrative offices in Sacramento. See < (last visited Nov., 0) (attached hereto as Exhibit 1). This posting was misleading in that it conveyed the false impression that no medical information whatsoever was released, and it minimized the nature of the data breach.. Through a press release dated that same day, Defendants stated that the stolen computer held a database that included two types of information: 1. For approximately. million patients whose health care provider is supported by Sutter Physician Services (SPS), the database included only the following patient demographic information dated from to January 0: name, address, date of birth, phone number and address (if provided), medical record number and the name of the patient's health insurance plan. SPS is an organization that provides billing and managed care services for health care

3 providers with which it contracts, including facilities within the Sutter Health network..... For approximately,000 [SUTTER MEDICAL FOUNDATION ( SMF )] patients, the database contained the above demographic data as well as the following information dated from January 00 to January 0: dates of services and a description of medical diagnoses and/or procedures used for business operations. Because the data of SMF patients was broader in scope, Sutter Medical Foundation has begun the process to notify these patients by mail. Patients should receive letters no later than Dec.. (Press Release, Nov., 0, attached hereto as Exhibit.). Plaintiff falls into the second group of patients identified above, whose medical information and other confidential and protected information was disclosed. PARTIES. Plaintiff DOROTHY ATKINS is a resident of the State of California.. Defendant SUTTER MEDICAL FOUNDATION is a corporation organized under the laws of California. California.. Defendant SUTTER HEALTH is a corporation organized under the laws of. Defendant SUTTER PHYSICIAN SERVICES, is a California business entity affiliated with SUTTER MEDICAL FOUNDATION and SUTTER HEALTH.. The true names and capacities, whether individual, corporate, associate or otherwise, of each of the defendants designated as a DOE are unknown to Plaintiff at this time and therefore Plaintiff sues these defendants by such fictitious names. Plaintiff will ask leave of the Court to amend this Complaint to show the true names and capacities of the DOE defendants when that information has been ascertained. Each of the defendants designated herein as a DOE is legally responsible in some manner and liable for the events and happenings herein alleged and, in such manner, proximately caused harm to Plaintiff as further alleged herein.. Each of the named Defendants acted as the employee, agent, affiliate, partner, alter-

4 ego and/or joint venturer of each of the other named Defendants and, in doing the acts and carrying out the wrongful conduct alleged, each of the Defendants acted within the scope of said relationship with the permission, consent and ratification of each of the other named Defendants. JURISDICTION AND VENUE. This Court has personal jurisdiction over all Defendants because each is a resident of and/or incorporated in the state of California.. Venue is proper in this County in accordance with California Code of Civil Procedure -, because the causes of action arose in this County. Among other things, Plaintiff was treated at Eden Medical Center, which is located in this County and, according to Defendants, is one of the impacted health care providers at issue. (Exhibit 1.) GENERAL ALLEGATIONS. Plaintiff has been a patient of Defendants and, as such, provided confidential information to them including her name, personal information, social security number, age, address, and health information. At no time during did Plaintiff provide written authorization allowing Defendants disclosure of her private medical information.. Defendants negligently maintained the private medical information of patients, including Plaintiff and the Class (as defined below), in an unencrypted computerized format. According to Defendants publications concerning the data breach, on or about October, 0, the computer was stolen from SMF s administrative offices in Sacramento, and contained medical information of more than. million patients, including the patients name, medical record numbers, ages, and, in many cases, medical information including dates of services and descriptions of medical diagnoses and/or procedures.. Defendants disclosed the medical information of Plaintiff and the Class without obtaining written authorization.

5 In November 0, Defendants announced that the private medical information of more than. million patients was stolen from SMF s administrative offices in October. See Exhibit Defendants also published a press release concerning the data breach, attached hereto as Exhibit. 1. Defendants announcements state that a company-issued, password protected, unencrypted desktop computer was stolen from SMF s administrative offices the weekend of October, Defendants announcements state that for. million patients, the database contained their names, addresses, dates of birth, phone number and address, medical record number and the name of the patient s health insurance plan. Defendants website announcement (Exhibit 1), however, is misleading in that it conveyed the false impression that no medical information whatsoever was released, and it minimized the nature of the data breach. For approximately,000 patients, including Plaintiff, the database contained additional information, including dates of services, description of medical diagnoses and/or procedures used for business operations. 0. Although Defendants admit they knew of their data security incident in October 0, they waited until November, before making any announcement. 1. In addition, Defendants have failed to notify the individual patients affected in a timely manner, as required by California law.. Plaintiff is informed and believes, based on telephone conversations with Defendants, that her medical information was included on the stolen computer.. Plaintiff has yet to receive any written notification from Defendants regarding their loss of her information, as required by California law.

6 CONSEQUENCES OF DEFENDANTS CONDUCT. The ramifications of Defendants loss of confidential medical data belonging to Plaintiff and similarly situated persons are severe.. Californians have a constitutional right of privacy in their medical information, because such information is among the most sensitive type of personal information that exists.. The loss of such sensitive information is highly offensive to those whose information is disclosed, and potentially embarrassing and damaging.. California s Confidentiality of Medical Records Act was enacted to govern the conduct of entities such as Defendants, to whom California residents entrust such highly sensitive information, and provides for statutory damages in an effort to prevent unauthorized disclosures and provide a clear remedy those affected, regardless of monetary loss.. Moreover, the loss of such information presents a threat of identity theft. The information Defendants lost is as good as gold to identity thieves, in the words of the Federal Trade Commission ( FTC ). FTC, About Identity Theft, available at < (last visited Nov., 0). Identity theft occurs when someone uses another s personal identifying information, such as that person s name, Social Security Number, or credit card number, without permission to commit fraud or other crimes. Id. The FTC estimates that as many as million Americans have their identities stolen each year. Id.. Identity thieves may get medical services using the Plaintiffs lost information or commit any number of other frauds, such as obtaining a job, procuring housing, or even giving false information to police during an arrest. 0. In addition to the financial harm associated with other types of identity theft, victims of medical identity theft may have their health endangered by inaccurate entries in their medical

7 records. This inaccurate information can potentially cause victims to receive improper medical care, have their insurance depleted, become ineligible for health or life insurance, or become disqualified from some jobs. Victims may not even be aware that a theft has occurred because medical identity theft can be difficult to discover, as few consumers regularly review their medical records, and victims may not realize that they have been victimized until they receive collection notices, or they attempt to seek medical care themselves, only to discover that they have reached their coverage limits. The President's Identity Theft Task Force Report at p.0 (Oct. 1, 00), available at < (last visited November, 0). 1. With the advent of the prescription drug benefit of Medicare Part D, the Department of Health and Human Services Office of the Inspector General (HHS OIG) has noted a growing incidence of health care frauds involving identity theft. Identity thieves can use such information fraudulently to enroll unwilling beneficiaries in alternate Part D plans in order to increase... sales commissions or commit other types of fraud. The types of fraud that can be perpetrated by an identity thief are limited only by the ingenuity and resources of the criminal. Id. at 1.. According to the U.S. Government Accountability Office ( GAO ), which conducted a study regarding data breaches: [L]aw enforcement officials told us that in some cases, stolen data may be held for up to a year or more before being used to commit identity theft. Further, once stolen data have been sold or posted on the Web, fraudulent use of that information may continue for years. As a result, studies that attempt to measure the harm resulting from data breaches cannot necessarily rule out all future harm. GAO, Report to Congressional Requesters, at p. (June 00), available at < (last visited November, 0).. Plaintiff and the Class she seeks to represent now face years of constant surveillance of their financial and medical records, monitoring, loss of rights, and potential medical problems.

8 CLASS ACTION ALLEGATIONS. Plaintiffs bring this action on her own behalf, and on behalf of all other persons similarly situated ( the Class ). The Class that Plaintiff seeks to represent is: All persons residing in the State of California whose personal information was held on the computer stolen over the weekend of October, 0, from Sutter Medical Foundation s administrative office. Excluded from the Class are Defendants; officers, directors, and employees of Defendants; any entity in which Defendants have a controlling interest; the affiliates, legal representatives, attorneys, heirs, and assigns of the Defendants. Also excluded from the Class are judicial officers presiding over the matter and the members of their immediate families and judicial staff.. The members of the Class are so numerous that the joinder of all members is impractical. While the exact number of Class members is unknown to Plaintiff at this time, based on information and belief, it is at least approximately. million.. There is a well-defined community of interest among the members of the Class because common questions of law and fact predominate, Plaintiff s claims are typical of the members of the Class, and Plaintiff can fairly and adequately represent the interests of the Class.. Plaintiff will vigorously pursue the claims of the class, and has retained counsel who are competent and experienced in consumer class action litigation, who have successfully represented plaintiffs in prior complex class actions.. This action involves questions of law and fact common to the members of the Class that predominate over any questions affecting only individual members, including, but not limited to: a. Whether Defendants unlawfully used, maintained, lost or disclosed Class members personal, financial and medical information; b. Whether Defendants conduct violated the California Confidentiality of Medical Information Act, Civil Code et seq.;

9 c. Whether Defendants conduct violated the California Civil Code 1.; d. Whether Defendants conduct was negligent; e. Whether Defendants acted willfully and/or with oppression, fraud, or malice; f. Whether Plaintiffs and the Class are entitled to damages, civil penalties, punitive damages, and/or injunctive relief.. Plaintiff s claims are typical of those of other Class members because Plaintiff s information, like that of every other class member, was misused and/or disclosed by Defendants. 0. Plaintiff will fairly and accurately represent the interests of the Class. 1. The prosecution of separate actions by individual members of the Class would create a risk of inconsistent or varying adjudications with respect to individual members of the Class, which would establish incompatible standards of conduct for Defendants and would lead to repetitive adjudication of common questions of law and fact. Accordingly, class treatment is superior to any other method for adjudicating the controversy. Plaintiffs know of no difficulty that will be encountered in the management of this litigation that would preclude its maintenance as a class action.. Damages for any individual class member are likely insufficient to justify the cost of individual litigation, so that in the absence of class treatment, Defendants violations of law inflicting substantial damages in the aggregate would go un-remedied without certification of the Class. FIRST COUNT Violation of the California Confidentiality of Medical Information Act, Civil Code et seq. (Against All Defendants) here.. Plaintiff incorporates the substantive allegations contained in all previous paragraphs. California s Confidentiality of Medical Information Act, Cal. Civ. Code, et seq.

10 ( CMIA ) prohibits health care providers from disclosing medical information regarding a patient without first obtaining written authorization from the patient.. Defendants had a legal duty to protect the confidentiality of Plaintiff s and other class members medical information.. By disclosing the private medical information of Plaintiff and the class without written authorization, Defendants violated section. of the CMIA.. Defendants also violated section.1 of the CMIA, which prohibits the negligent creation, maintenance, preservation, storage, abandonment, destruction, or disposal of confidential medical information. Among other things, Defendants are and were negligent by failing to store patients medical information in encrypted form; failing to use reasonable security procedures to prevent unauthorized access to data files and computer equipment; and failing to implement and maintain reasonable security and tracking procedures to protect medical information from unauthorized access and disclosure.. Defendants misuse and/or disclosure of medical information regarding the Plaintiff and the Class constitutes a violation of Civil Code.,.1,.,., and... Plaintiff and the Class have suffered damages from the improper misuse and/or disclosure of their medical information and therefore Plaintiff and the Class seek relief under Civil Code. and.. 0. Plaintiffs and the Class seek actual damages, statutory damage, statutory penalties, attorney fees and costs pursuant to Civil Code. and.. SECOND COUNT Violation of the Customer Records Act, Cal. Civ. Code 1. (Against all Defendants) 1. Plaintiff incorporates the substantive allegations contained in all previous paragraphs

11 here.. The missing desktop computer and data files included personal information within the meaning of California Civil Code 1.. Accordingly, Defendants had an obligation to promptly disclose any breach in the security of those files to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.. The information security incident occurred over the weekend of October, 0 and Defendants had knowledge of the incident when it occurred. However, they unreasonably delayed notifying Plaintiff and other Class members in violation of California Civil Code 1... Defendants waited until at least November, 0, to make any sort of statement regarding the loss of data, and have totally failed to provide proper individual notice as required by 1... Detailed information about the type of health information or financial information that has been compromised is essential to a meaningful disclosure. The underlying purpose of section 1. is to allow California residents whose personal information has been compromised to make an intelligent and prompt decision about what actions to take, which may possibly include placing a fraud alert or security freeze on their credit files; or checking their credit reports and health benefit statements on regular intervals for irregular activity. Defendants have not taken adequate measures to inform Plaintiff and Class members about the theft of their private and confidential health and financial information. Therefore they have not been able to make the prompt and intelligent decisions contemplated by 1... Pursuant to Civil Code 1.(e), Plaintiff seeks an order requiring Defendants to make a detailed disclosure to Plaintiff and Class members of the type of health and financial information included on the missing computer and requiring Defendants to notify Plaintiff and Class

12 members of any future security breaches promptly and with sufficient detail. here. THIRD COUNT Negligence (Against All Defendants). Plaintiff incorporates the substantive allegations contained in all previous paragraphs. Plaintiff and other Class members entrusted Defendants with their private information, and Defendants had a duty to exercise reasonable care to safeguard and protect that information from theft or other loss, misuse, and/or disclosure to unauthorized parties.. Defendants had a duty to timely disclose that Plaintiff s private information had been compromised. 0. Defendants, through their actions and/or omissions, unlawfully breached their duty to Plaintiff and the Class by failing to exercise reasonable care in protecting and safeguarding Plaintiff s and other Class members private information. Among other negligent acts, Defendants failed to maintain the lost information in an encrypted format. 1. Defendants, through their actions and/or omissions, unlawfully breached their duty to timely disclose to Plaintiff and other Class members the fact that their private information had been compromised.. Defendants negligent and wrongful breach of their duties owed to Plaintiff and the Class proximately caused the loss of Plaintiff s and other Class members private information.. Plaintiff seeks the award of actual damages on behalf of the Class.

13 FOURTH COUNT Invasion of Privacy - Intrusion, Public Disclosure of Private Facts, Misappropriation of Likeness and Identity, and California Constitutional Right to Privacy (Against All Defendants). Plaintiff incorporates the substantive allegations contained in all previous paragraphs here.. Plaintiff had a reasonable expectation of privacy in the private information Defendants mishandled.. By failing to keep Plaintiff s and other Class members information safe, and by misusing and/or disclosing said information to unauthorized parties for unauthorized use, Defendants invaded Plaintiff s and other Class members privacy by: a. intruding into Plaintiff s and other Class members private affairs in a manner that would be highly offensive to a reasonable person; b. publicizing private facts about Plaintiff and other Class members, which is highly offensive to a reasonable person; c. using and appropriating Plaintiff s and other Class members identities without their consent; and d. violating Plaintiff s and other Class members right to privacy under California Constitution, Article 1, Section 1, through the improper use of their private information properly obtained for a specific purpose for another purpose, or the disclosure of it to some third party.. Defendants knew, or acted with reckless disregard of the fact that, a reasonable person in Plaintiff s position would consider Defendants actions highly offensive.. Defendants invaded Plaintiff s and other Class members right to privacy and intruded

14 into their private affairs by misusing and/or disclosing their private information without their informed, voluntary, affirmative and clear consent.. As a proximate result of such misuse and disclosures, Plaintiff s and other Class members reasonable expectations of privacy in their private information were unduly frustrated and thwarted. Defendants conduct amounted to a serious invasion of Plaintiff s and other Class members protected privacy interests. 0. In failing to protect Plaintiff s and other Class members private information, and in misusing and/or disclosing that information, Defendants have acted with malice and oppression and in conscious disregard of Plaintiff s and other Class members rights to have such information kept confidential and private. Plaintiff, therefore, seeks an award of punitive damages on behalf of the Class. PRAYER FOR RELIEF WHEREFORE Plaintiff prays for judgment as follows: A. For an Order certifying this action as a class action and appointing Plaintiff and her counsel to represent the Class; B. For equitable relief enjoining Defendants from engaging in the wrongful conduct complained of herein pertaining to the misuse and/or disclosure of Plaintiff s and Class members private information; and to comply with California Civil Code 1. by promptly notifying its members regarding this and any future security breaches, including with a detailed description of the type of health and/or financial information implicated; C. Statutory damages of $1, for each class member; D. For an award of actual damages, compensatory damages, statutory damages, and statutory penalties, in an amount to be determined; E. For an award of punitive damages;

15 F. For an award of costs of suit and attorneys fees, as allowable by law; and G. Such other and further relief as this court may deem just and proper Dated: November, 0 AHDOOT & WOLFSON, PC By: Tina Wolfson Attorneys for Plaintiff DOROTHY ATKINS

16 DEMAND FOR JURY TRIAL Plaintiff hereby demands a jury trial of her claims to the extent authorized by law. Dated: November, 0 AHDOOT & WOLFSON, PC By: Tina Wolfson Attorneys for Plaintiff DOROTHY ATKINS

17 Exhibit 1

18 An Important Notice for Patients Regarding Stolen Computer // : PM Display Mode Default Style High Contrast An Important Notice for Patients Regarding Stolen Wednesday, Nov., 0 Computer During the weekend of Oct. -, 0, a password-protected unencrypted desktop computer was stolen from Sutter Medical Foundation s administrative offices in Sacramento. Sutter Health learned of the theft on Monday, Oct. 1, 0, immediately reported it to the Sacramento Police Department, and began a thorough internal investigation. The computer did not contain patient financial records, social security numbers, patients health plan identification numbers or medical records. Sutter Health holds the confidentiality and trust of our patients in the highest regard, and we deeply regret that this incident has occurred. Please know these details: For approximately. million patients whose health care provider is supported by Sutter Physician Services (SPS), the database included only the following demographic information dated from to January 0: name, address, date of birth, phone number and address (if provided), medical record number and the name of the patient s health insurance plan. SPS provides billing and managed care services for health care providers with which it contracts, including facilities within the Sutter Health network. The impacted health care providers include: Albany Family Practice Alta Bates Medical Associates Alta Bates Medical Group Alta Bates Summit Medical Center Central Valley Medical Group County of Yolo Department of Health Eden Medical Center Family Doctor Medical Group Oakcare Medical Group San Leandro Hospital Sutter Amador Hospital Sutter Coast Hospital Sutter East Bay Medical Foundation Sutter Express Care Sutter Gould Medical Foundation Page 1 of

19 An Important Notice for Patients Regarding Stolen Computer // : PM Sutter Independent Physicians Sutter Lakeside Hospital Sutter Medical Center, Sacramento Sutter Medical Center of Santa Rosa Sutter Medical Foundation Sutter Pacific Medical Foundation Sutter Select What We re Doing Sutter Health has established a toll-free helpline to answer questions and assist patients in determining whether their data was included. Any concerned patients can call toll-free at 1 () 0-000, Monday through Friday from a.m. to p.m. PST. When prompted, patients should enter this -digit reference code:. The Sutter Health Data Security Office has already encrypted portable laptops and blackberries systemwide, and was in the process of encrypting desktop computers throughout the system when the theft took place. Sutter Health has since accelerated its efforts to encrypt all computers and has implemented routine security software updates. Encryption technology scrambles each computer s data in a way that makes it very difficult for an unauthorized user to retrieve the information. Sutter Health also will be reinforcing security practices with staff systemwide. What Patients Can Do Page of

20 An Important Notice for Patients Regarding Stolen Computer // : PM While there were no health insurance policy numbers on the computer, as a precaution we still encourage patients to always review their explanation of benefits and other correspondence from their insurance carrier and to report any suspicious activity immediately. Page of

21 Exhibit

22

23 Sutter Health Informs Patients of Stolen Computer -- SACRAMENTO, Calif., Nov., 0 /PRNewswire/ -- // : PM The Sutter Medical Network includes many of California s top performing highest quality physician organizations as measured annually by the ntegrated Healthcare Association Sutter affiliated hospitals are regional leaders in cardiac care women s and children s services cancer care orthopedics and advanced patient safety technology For more information about the not for profit Sutter Health network please visit www SutterHealth org View and download archived video content distr buted by MultiVu on The Digital Center. SOURCE Sutter Health Back to top RELATED L NKS sutterhealth org Free Investing Newsletter from Investor Uprising! Custom Packages Browse our custom packages or bui d your own to meet your unique communications needs Start today PR Newswire Membership Fi out a PR Newswire membership form or contact us at () -0 Next in Health Care & Hospitals News Learn about PR Newswire services Request more information about PR Newswire products and services or ca us at () - 0 Learn to navigate the world's financial system and profit from leading companies. Register for Investor Uprising, the people's investment site, for a free weekly newsletter, information, education and premium research including our latest IU Confidential Report - "All The Glitters: The Ultimate Gold Report". About PR Newswire Contact PR Newswire PR Newswire s Terms of Use Apply Careers Privacy Site Map RSS Feeds Blog Copyright 0 PR Newswire Association LLC All Rights Reserved A UBM plc company Dynamic Site Platform powered by Limelight Networks Page of