St. Joseph Health System has settled a class action lawsuit filed by two plaintiffs for the breach of 31,800 patient health records that took place in 2012. A settlement of $15 million will be split between patients and attorneys, with $7.5 million going to patients and $7.5 million covering attorneys’ fees and legal costs. All patients affected by the breach will receive a check for $242.
A $3 million fund has also been set up to cover Identity theft losses that resulted from the exposure of patient health data. Each patient can potentially claim up to $25,000 if they can demonstrate they have suffered losses as a result of the data breach.
The data breach in question lasted almost a year and affected patients from a number of hospitals and medical centers run by St. Joseph Health, including Queen of the Valley Medical Center in Napa, Santa Rosa Memorial Hospital, Petaluma Valley Hospital; St. Jude Medical Center in Fullerton, the Auxiliary of Mission Hospital in Mission Viejo and Laguna Beach, Redwood Memorial Hospital of Fortuna, Saint Joseph Hospital of Orange and Eureka.
Full medical records were not released and Social Security numbers were not exposed, although the names of patients, medical diagnoses, lab test results, medication allergies and personal health information such as body mass indexes were all potentially accessible over the Internet. The data were indexed by search engines such as Yahoo and Google. According to the plaintiffs, the data could easily be found in the search engines, although St. Joseph Health maintained that this would require very specific searched to have been conducted. The data exposure occurred as a result of misconfigured security settings.
St. Joseph Health System released a statement apologizing for error and for causing undue concern to patients. It was pointed out that patient health data were subsequently secured and were de-indexed from the search engines.
St. Joseph Health has since implemented a number of protections to improve safety and security, which include an enhanced data security infrastructure. The system upgrade to improve security cost St. Joseph Health more than $17 million and a further $4.5 million was spent on providing credit monitoring services to all breach victims.