A ransomware attack, discovered last week, against the EHR vendor Allscripts lead to thousands of healthcare suppliers being prevented from accessing patient data or using the e-prescription service. Florida-based Surfside Non-Surgical Orthopedics have moved quickly to register a class action lawsuit against Allscripts.
Allscripts is a supplier of EHR and e-prescription services to 2,500 hospitals and 19,000 post-acute care centers. Last week, a new type of SamSam ransomware was downloaded to the company´s data centers in Raleigh and Charlotte, NC, leaving 1,500 clients unable to log on to several online applications .
Response teams from Microsoft and Cisco assisted the company to restore its e-prescribing service by Saturday; but, for a lot of clients, the Allscripts PRO EHR system is still unavailable or experiencing intermittent outages. An Allscripts representatives have been unable to confirm when a full restore will be finished.
The class action lawsuit against Allscripts was registered in the United States District Court for the Northern District of Illinois where the company is located. It claims Allscripts was negligent in failing to safeguard their systems against cyberattacks and that the company was aware of flaws in its online security. The complaint refer to the company´s most recent 10-K filing which states: “If our security is breached, we could be subject to liability, and our clients could be deterred from using our products and services”.
Lawyers representing the plaintiff – Florida-based Surfside Non-Surgical Orthopedics – Allscripts predicted the ransomware attack in the K-10 filing; and, due to the attack, their client experienced “significant business interruption and disruption, and lost revenues”. The class action lawsuit taken against Allscripts also claimss breach of contract, unjust enrichment, and breaches of Illinois´ Uniform Deception Trade Practices Act and Consumer Fraud Act.
Steven Tapper – a member of class action lawsuit against Allscripts –feels the ransomware attack could have targeted many more clients than the company is admitting. He stated to reporters: “We really don’t know. Allscripts hasn’t disclosed the full extent of the impact”. His colleague – John Yanchunis – added it could take as long as eighteen months to resolve the case, but Allscripts may choose to seek an immediate resolution. “I would hope that would be the case here,” he added.