📋 Free Download: 2026 HIPAA Compliance Checklist — updated for the latest OCR enforcement priorities. Get it free →

Back to Blog
Fraud & Abuse

Over $1 Billion in Damages Sought in Healthcare Lawsuit

A landmark healthcare lawsuit seeking over $1 billion in damages — the allegations and their implications.

April 2026 3 min read AXIS CloudSync Compliance Team
Share
Prefer to listen? Hit play — audio available.
Listen

[00:00.0 - 00:02.8] In order to receive incentive payments, [00:02.8 - 00:05.7] one of the requirements was for hospitals to attest [00:05.7 - 00:08.2] that for at least 50% of patients, [00:08.2 - 00:10.6] they were able to provide copies of medical records [00:10.6 - 00:13.8] within three business days of requests being submitted. [00:13.8 - 00:16.2] When copies of health records are requested, [00:16.2 - 00:19.2] the HOT Tech Act only permits healthcare organizations [00:19.2 - 00:22.7] to charge for labor costs for supplying copies of records. [00:22.7 - 00:24.6] Michael Misch and Bradley Coborn, [00:24.6 - 00:27.7] attorneys with Anderson, Agostino, and Keller, [00:27.7 - 00:29.7] PC of South Bend, Indiana, [00:29.7 - 00:32.1] investigated hospitals after growing frustrated [00:32.1 - 00:35.3] with the delay in obtaining copies of health records [00:35.3 - 00:37.1] at their client's request, [00:37.1 - 00:38.7] and over the amounts being charged [00:38.7 - 00:40.5] for copies of health records.

[00:40.5 - 00:43.9] The aim of the investigation was to streamline requests, [00:43.9 - 00:47.5] reduce the time taken to obtain copies of health records, [00:47.5 - 00:51.1] and reduce the cost of accessing those records. [00:51.1 - 00:53.9] However, the investigation revealed that many hospitals [00:53.9 - 00:57.3] were failing to meet the requirements of the HITECH Act, [00:58.0 - 00:59.5] even though they had received incentive payments [00:59.5 - 01:00.9] for compliance. [01:00.9 - 01:02.5] In the complaint, it is alleged [01:02.5 - 01:04.7] that 60 hospitals received payments [01:04.7 - 01:09.4] of $324.4 million in HITECH Act grant funding, [01:09.4 - 01:11.9] yet failed to meet the requirements of the HITECH Act [01:11.9 - 01:13.4] when it came to providing copies [01:13.4 - 01:15.4] of health records of patients.

[01:15.4 - 01:18.2] The lawsuit also alleges the hospitals violated [01:18.2 - 01:22.3] the anti-kickback statute and the False Claims Act, [01:22.3 - 01:24.8] falsely claiming compliance with HITECH Act [01:24.8 - 01:26.8] to gain access to public funding. [01:27.5 - 01:30.3] Patient sues BJC Health System [01:30.3 - 01:32.9] over Barnes-Jewish Hospital Prional. [01:32.9 - 01:35.0] A patient whose protected health information [01:35.0 - 01:37.6] was exposed as a result of a security breach [01:37.6 - 01:40.8] at Barnes-Jewish Hospital in St.

Louis, MO, [01:40.8 - 01:43.4] has filed a complaint in the St. Louis Circuit Court [01:43.4 - 01:47.4] against the hospital operator, BJC Health System. [01:47.4 - 01:49.9] Megan L.

Roseman claims BJC Health System [01:49.9 - 01:52.5] allowed unauthorized individuals to gain access [01:52.5 - 01:55.0] to the protected health information of patients, [01:55.0 - 01:58.1] and failed to adequately protect patient data. [01:58.1 - 02:00.9] She alleges BJC Health System was negligent [02:00.9 - 02:03.3] and breached its fiduciary duty. [02:03.3 - 02:05.6] Roseman claims the exposure of her information [02:05.6 - 02:07.3] places her at an increased risk [02:07.3 - 02:11.5] of identity theft, abuse, and exploitation.

[02:11.5 - 02:13.9] The lawsuit names Roseman as the plaintiff, [02:13.9 - 02:16.9] along with other individuals affected by the breach. [02:16.9 - 02:20.2] Roseman is seeking a class certification and trial by jury. [02:20.2 - 02:23.7] A jury trial has been scheduled for May 14th, 2018.

[02:23.7 - 02:26.7] BJC Healthcare reported the unauthorized accessing [02:26.7 - 02:28.6] of an email account to the Department of Health [02:28.6 - 02:31.0] and Human Services Office for Civil Rights [02:31.0 - 02:33.9] on February 26th, 2016. [02:33.9 - 02:37.6] The breach impacted 2,093 patients. [02:37.6 - 02:42.1] The case is still marked as under investigation by OCR.

[02:42.1 - 02:43.9]

Ready to protect your organization?

AXIS CloudSync gives healthcare, legal, and financial teams enterprise-grade encryption, audit logs, and a BAA — ready from day one.

Schedule a Demo
Schedule a Demo