University of Miami Data Breach Leads to Class Action Lawsuit

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

A Florida resident has filed a consumer class action lawsuit against the University of Miami, alleging that the University failed to adequately safeguard her health records and other personally identifiable information after it was disclosed that unauthorized access to the school’s offsite computer storage systems had occurred sometime in the Summer of 2013.

The lead plaintiff in the class action lawsuit, Joan Carsten, claims that her and potentially thousands of other patients’ medical information and private identifying information, including social security numbers, names, dates of birth, and billing information, was compromised during the data breach.

The University of Miami data breach class action lawsuit alleges that the defendants, which include a medical school and health care system where Carsten was a patient, sent Carsten’s and others’ medical and private information electronically to a third-party offsite records vendor without “securing the information in a manner that would prohibit unauthorized access.”

Carsten states in the class action lawsuit that the University sent her a letter on Feb 3, 2014, informing her that the University had learned that the third-party vendor was not able to locate her and other patients’ records on June 27, 2013, and those records were not in possession of either the University of Miami or the vendor on Aug 28, 2013.

Carsten alleges that on those dates an unauthorized person or people intentionally accessed patients’ information and then intentionally misused and disclosed that information to others for profit. Carsten notes that the University has not provided specific information about the unauthorized access, what action has been taken to further safeguard her and others’ information from further unauthorized access, and has not explained its delay in notification as well.

Carsten maintains in her class action lawsuit that this unauthorized access of information included access to social security numbers and private identifiable information, both of which are entitled to a high level of protection under case law, the Fair Credit and Reporting Act, and HIPAA. The complaint seeks to bring this as a class action lawsuit on behalf of “all persons throughout the United States who were patients of [the University of Miami] and who had their personal identifying information breached.”

Carsten claims that the University of Miami hospital breach resulted in unauthorized use of her bank account and has put her and others at “grave risk” of fraud and identity theft. The class action lawsuit charges the University with negligence regarding their acceptance and storage of medical information, willful and negligent violation of the Fair Credit Reporting Act, and violated Florida’s Deceptive and Unfair Trade Practices Act.  Carsten seeks restitution for damages to her, for the University to “disgorge all ill-gotten gains flowing from the wrongful conduct,” to prevent the University from engaging in similar conduct in the future, and to require the University to “engage in a correct notice campaign.”

Carsten is a resident of Dade County, Florida. The University of Miami operates both a medical school and a health care system in the area. Carsten claims that individuals affected by this breach could include many thousands, both in the area and out of state, who were patients at University of Miami’s medical school and/or health care system.

Carsten is represented by John A. Yanchunis of Morgan & Morgan PA.

The University of Miami Data Breach Class Action Lawsuit case is Carsten v. University of Miami, Case No. 1:14-cv-20497, in the U.S. District Court for the Southern District of Florida.

UPDATE: A settlement has been reached in the University of Miami data breach class action lawsuit. Claim filing instructions are available here or at www.CarstenSettlement.com.