Class Action Accuses UCLA Health System of Data Breach

Last week, a class action lawsuit was filed against UCLA Health System Auxiliary alleging that UCLA Health failed to adequately protect patients’ personal medical information, potentially leading 4.5 million people to be exposed to data thieves.

Lead plaintiff Michael Allen filed the class action lawsuit in California federal court on July 20, alleging that UCLA Health failed to encrypt patients’ medical records, exposing them to a data breach that UCLA Health recently announced. The plaintiff argues that UCLA Health had a contractual obligation to provide adequate security measures to protect patient data, but failed to provide basic encryption necessary to avoid this most recent hack.

“Due to defendants’ failure to take the basic steps of encrypting patients’ data, it was much easier for cyber thieves to interpret the information, use it to steal the identities of defendants’ patients, or sell to others who would use defendants’ patients’ personal and health information,” Allen alleges in the class action lawsuit.

Allen alleges that he disclosed his personal information during visits to the UCLA medical center, including Social Security numbers, names, Medicare numbers, addresses and more. The announcement of the hack by UCLA Health exposes him and potentially millions of other patients to identity theft, according to the UCLA data breach class action lawsuit.

Allen also alleges that UCLA Health has known about the breach since October, but did not announce the breach in a timely manner, further exposing patients to identity theft.

The data breach class action lawsuit further argues that UCLA Health should have known it was a potential target for hackers because of the recent trend and warnings from security experts that data thieves were focusing on “big players” in the health care industry. “Defendants knew or should have known of the risks inherent in maintaining their customers’ nonpublic personal and health information, and if such information was stolen, it would have dire consequences for those customers,” the UCLA class action lawsuit alleges.

UCLA Health says it has been working with the Federal Bureau of Investigation which indicates hackers have accessed parts of its servers that contains patient information, but contends that it cannot confirm that any information was stolen.

The data breach class action lawsuit accuses UCLA Health and the university’s board of regents of fraud, invasion of privacy, breach of contract, negligence and violating California laws, including the Confidentiality of Medical Information Act (CMIA). The CMIA entitles individual Class Members to $1,000 in statutory damages plus an additional $3,000 in punitive damages. The plaintiff is also seeking $1,000 per violation of California’s Business & Professions Code, according to the UCLA Health class action lawsuit.

One year of identity theft recovery and restoration services, as well as a year of credit monitoring, has reportedly been offered to patients affected by the breach by UCLA Health.

Michael Allen is represented by Kevin Mahoney of Mahoney Law Group APC and Briana M. Kim of Briana Kim PC.

The UCLA Health Data Breach Class Action Lawsuit is Allen v. UCLA Health Systems Auxiliary, et al., Case No. 2:15-cv-05487, in the U.S. District Court for the Central District of California.