The parent of a pediatric patient seen at Ann & Robert H. Lurie Children's Hospital of Chicago is suing the hospital over two recent data breaches.
An unnamed Jane Doe and her daughter, an unnamed Baby Doe, filed the complaint against Lurie Children's and two former employees accused of viewing thousands of patient records without a valid reason in the Circuit Court of Cook County on Friday. The plaintiffs, represented by law firm Edelson P.C., are seeking class action status.
Lurie Children's this week released a public notice that a now former employee had improperly viewed thousands of patient records over the course of more than a year, just a few months after notifying patients about a similar incident in December 2019. Both employees were nurse assistants, according to an email from a hospital spokesperson.
In both cases, Lurie Children's fired the employees in question. Lurie Children's has said it's found no evidence to suggest that either employee had misused patient information they accessed.
Healthcare organizations reported more than 570 data breaches in 2019 alone, according to a report from healthcare analytics company Protenus. Patients can find breaches of their health data particularly difficult to deal with, since medical records can contain sensitive information they expect to stay within the walls of the hospital.
That was the case for Baby Doe, according to the complaint obtained by Modern Healthcare.
Baby Doe visited Lurie Children's in early 2019 for a forensic examination to investigate suspected sexual abuse. At the time, Baby Doe was 3 years old.
Baby Doe's patient records were reportedly accessed without authorization by the two nurse assistants. In the complaint, the plaintiffs' attorneys allege that earlier this year—before Lurie Children's had disclosed the second data breach—the hospital attributed the first data breach to "the curiosity of a bored employee."
Baby Doe is seeking damages for Lurie Children's "failure to implement meaningful security policies despite being paid to do so by their patients," as well as injunctive relief in the form of a trust fund to provide ongoing credit monitoring and identity theft response services.
A Lurie Children's spokesperson said the hospital has not seen any legal filings on the matter.
"Lurie Children's addressed this issue in accordance with our disciplinary policies, and the employees no longer work for the hospital," reads a statement from Lurie Children's emailed to Modern Healthcare. "We remain committed to providing the highest standard of patient care, as well as protecting the privacy and confidentiality of our patients."
