UPMC Data Breach Sparks Class Action Lawsuit

UPDATE 5/16/14: This class action lawsuit, filed May 9, was voluntarily dismissed by the plaintiff on May 13 after attorneys determined that one of the defendants, Ultimate Software Group, was not involved with UPMC.

“Our ongoing investigation has concluded that Ultimate Software Group was misidentified in our filing of last week and we have decided to dismiss them as a party to the suit,” attorney Benjamin Sweet told the Pittsburgh Post-Gazette in an email confirming the dismissal. Sweet said the class action lawsuit against UPMC will continue in Common Pleas Court. Our original article below on the UPMC data breach class action lawsuit has been updated to reflect the removal of Ultimate Software as a defendant.

Employees of the University of Pittsburgh Medical Center have filed a class action lawsuit against their employer, alleging that a data breach disclosed in February had compromised the identities of 27,000 employees.

Lead plaintiff Alice Patrick, a dialysis clinician at UPMC McKeesport, alleges in the class action lawsuit that in February UPMC notified its employees of a data breach affecting 22 employees. By March, the number of employees affected by the UPMC data breach had grown to 322, and by April, over 27,000 employees had been affected.

Patrick alleges that UPMC was negligent in collecting and storing their private information; “Defendants had a duty to exercise reasonable care to protect and secure Plaintiff’s and the members of the proposed Classes’ personal and financial information within their possession or control from being compromised, lost, stolen, misused, and/or disclosed to unauthorized parties” and “Defendants’ duty included, among other things, designing, maintaining, and testing their security systems to ensure that Plaintiff’s and the members of the proposed Classes personal and financial information in their possession was adequately secured and protected…defendants further had a duty to implement processes that would detect a breach of their security systems in a timely manner.”

Further, the UPMC data breach class action lawsuit alleges that UPMC “did not safeguard or protect Plaintiff’s and the proposed class members’ personal and financial information from being accessed, compromised, and/or stolen…[and] did not maintain sufficient security measures and procedures to prevent unauthorized access to Plaintiff’s and the proposed class members’ personal and financial information.”

“Because Defendants failed to safeguard and/or protect Plaintiff’s and the proposed class members’ personal and financial information from being compromised or stolen, Defendants breach their contracts with Plaintiff and the members of the proposed Classes,” argues the UPMC class action lawsuit.

The data breach included “[t]he personal and financial information of Plaintiff and the members of the proposed Classes, as well as their W-2 tax forms,” and “[t]he personal and financial information of Plaintiff and the members of the proposed Classes has been used to file fraudulent tax returns,” according to the UPMC class action lawsuit. Further, “Plaintiff and the members of the proposed Classes have suffered and will continue to suffer damages as the result of Defendants’ breach.” alleges the complaint.

Lead plaintiff, Alice Patrick, is represented by Michael L. Kraemer, David M. Manes and Elizabeth Pollock-Avery of Kraemer Manes & Associates LLC and by Gary F. Lynch, Edwin J. Kilpela Jr., Benjamin J. Sweet, Sunshine R. Fellows and Jamisen A. Etzel of Carlson Lynch Ltd.

The UPMC Data Breach Class Action Lawsuit is Patrick v. UPMC, Case No. 2:14-cv-00602, in the U.S. District Court for the Western District of Pennsylvania.