Banner Health Class Action Says Data Hack Exposed 3.7M

Top Class Actions’s website and social media posts use affiliate links. If you make a purchase using such links, we may receive a commission, but it will not result in any additional charges to you. Please review our Affiliate Link Disclosure for more information.

An Arizona woman has filed a data breach class action lawsuit against Banner Health, alleging the health care system negligently failed to protect millions of persons’ sensitive data from a recent data breach.

Plaintiff Kendra Clark says a cyberattack on Banner Health’s servers in June and July 2016 exposed the sensitive information of an estimated 3.7 million patients, care providers, and plan members and beneficiaries.

Clark argues Banner Health failed in its duty to protect that information, and she says it also failed to offer an adequate remedy to persons affected by the breach.

According to the Banner Health class action lawsuit, the defendant announced the breach publicly on Aug. 3, 2016.

At first, the company believed the attack exposed only credit card information like card numbers, expiration dates, and card holder’s names.

The company identified food and beverage outlets at its facilities in four states that were affected by the breach between June 23 and July 7.

Later, the company said it discovered the attack extended to information about patients, care providers and health plan beneficiaries.

Banner Health said the exposed health plan information may have included “names, birthdates, addresses, physicians’ names, dates of service, claims information, and possibly health insurance information and social security numbers.”

Clark claims the breach resulted directly from a failure by Banner Health to maintain adequate security measures that would protect sensitive data.

“Banner Health breached its duty to protect and safeguard Class Members’ personal, health, and financial information and to take reasonable steps to contain the damage caused where any such information was compromised,” she says.

Banner Health has offered persons whose data was exposed a free one-year subscription to monitoring services.

Clark argues that this offer is inadequate to guard against abuse of the stolen data. She seeks more robust credit monitoring specifically tailored to protect victims from fraud and identity theft, particularly the young, elderly and infirm.

Clark herself is a physician assistant who works within the Banner Health system. She says she received her own notification of the breach via letter on Aug. 8, 2016.

The letter allegedly informed her that the data breach may have exposed her “name, address, date of birth, DEA (Drug Enforcement Agency) number, TIN (Tax Identification Number), NPI (National Provider Identifier), or Social Security number.”

She says the letter contained barely any details about the breach and did not tell her exactly what information about her was stolen.

As proposed, this Banner Health class action lawsuit would represent a plaintiff Class consisting of “[a]ll former or present Banner Health patients, health plan members or health plan beneficiaries, food and beverage customers, or medical and healthcare providers who had their personal, medical, financial, or other sensitive information compromised as a result of the data breach of Banner Health’s computer servers that began on June 17, 2016.”

She seeks a court injunction that would require Banner Health to adopt best industry practices to secure sensitive data and to offer Class Members extended monitoring services to protect against the risk of identity theft, with a heightened level of protection for minor and elderly Class Members.

Clark is represented by attorneys Lincoln Combs and Paul L. Stoller of Gallagher & Kennedy PA; Benjamin F. Johns and Andrew W. Ferich of Chimicles & Tikellis LLP.

The Banner Health Data Breach Class Action Lawsuit is Kendra Clark v. Banner Health, Case No. 2:16-cv-02696, in the U.S. District Court for the District of Arizona.

UPDATE: On Dec. 5, 2019, a group of plaintiffs asked a federal judge in Arizona to approve a $6 million settlement resolving claims that 2.6 million individuals were affected by a 2016 Banner Health data breach.