Widener University Commonwealth Law School
MONTH-IN-BRIEF (Sep 2024)
Healthcare Data Breach Complaint Survives Motion to Dismiss
By Alan S. Wernick, Esq., Wernick & Associates, LTD.
Healthcare data breaches, in addition to impacting patient safety, typically top the list of data breaches most expensive to an industry.[1] In Cahill v. Memorial Heart Institute, the U.S. District Court for the Eastern District of Tennessee considered a motion by Defendant, a healthcare provider, to dismiss Plaintiffs’ complaint arising from a data breach at Defendant’s healthcare operations.[2] In its September 26, 2024, memorandum opinion, the Court denied Defendant’s motion to dismiss concerning Plaintiffs’ claims of negligence and breach of implied contract, and dismissed Plaintiffs’ other claims.
According to the alleged facts, “[o]n or before April 17, 2023, cyberthieves gained unauthorized access to Defendant’s information technology network. . . . [T]he criminal third parties accessed and exfiltrated private health and personal information (collectively ‘PII’), including social security numbers, of Plaintiffs and other current and former patients. Although Defendant discovered on May 31, 2023, that the cyberthieves had accessed 170,450 individuals’ private information in the data breach, Defendant did not notify the individuals identified as affected until July 28, 2023. More than two months later, Defendant disclosed that 411,000 people had been affected by the data breach, most of which were first notified on October 6, 2023.” This delayed notification was one of the factors the Court pointed to in not granting Defendant’s motion to dismiss Plaintiffs’ claims.
