The Aventura HIPAA breach, discovered in June 2014, has lead to a lawsuit being filed by a patient of the hospital, according to a Courthouse News Service report.
The lawsuit was taken by Aventura patient, Kellie Lynn Case, in the Miami Federal Court. She is claiming damages from the defendants, Hospital Corporation of America and Envision Healthcare Corporation, after they were supplied with confidential patient data and did not implement the appropriate controls to keep that data safe. The lawsuit claimes that the defendants have violated the HIPAA Security Rule in addition to Industry Standard Protection Protocols.
Under HIPAA regulations healthcare providers are not allowed to share confidential patient data without having first obtained permission to do so from the patients. They are also obliged to produce notices of privacy practices which must detail how the data they store will be used, to whom it will be gived and under what circumstances that will occur.
The lawsuit claims that the defendants used the Notice of Privacy Practices as a means to justify a rise in payments for medical services, and while that money was taken from patients, the security controls that it was supposed to cover had not in fact been implemented until after the hospital had experienced three data breaches, the latter being caused by one of its business associates, Valesco Ventures.
The lawsuit refers to false advertising, but also a failure of the hospital to provide training on HIPAA privacy and security obligations to the staff. It is also alleged that the staff worked without supervision and that privacy and security failures lead to sensitive data being stolen and used to commit medical fraud.
This is certainly not the first court case to be taken against a healthcare provider following a data breach. Many class action lawsuits and damages claims have been submitted in courts around the country. However, previous cases have all depended on whether actual harm and damage was been caused and without evidence that this was definitely the case the cases have been ruled in favor of the defendants.
This lawsuit differs in that the claim is being made for breach of contract damages, breach of implied contract and unjust enrichment after Case paid for services that she was not in receipt of.