Adaptive Health Half a Million Persons Data Breach Class Action

Medscan Laboratory, Inc., which does business as Adaptive Health Integrations (AHI), offers healthcare billing software and services for doctors’ offices and other healthcare entities. Among other things, says the complaint for this class action, it helps process healthcare claims submissions and claim remittances. Unfortunately, it suffered a data breach, which exposed the personally identifiable information (PII) of more than half a million people.

The complaint alleges that AHI did not have a privacy notice on its website.

On October 17, 2021, an unauthorized third party entered AHI’s systems, the complaint says, and was able to gain access to records containing the PII of some 510,000 persons. The company “confirmed” the data breach, the complaint says, on or about February 23, 2022, but only began sending out the Notices two months later, on April 5, 2022, and only notified the Department of Health and Human Services on April 11.

The PII exposed in the data breach included names, addresses, dates of birth, and Social Security numbers. The complaint alleges that the persons whose information was stolen “now face a lifetime risk of identity theft…”

AHI bears responsibility for the data breach, the complaint alleges: “This PII was compromised due to [AHI’s] negligent and/or careless acts and omissions and the failure to protect the PII…” It cites AHI’s waiting for more than six weeks after discovering the data breach before reporting it to government agencies and to the individual victims. “Upon information and belief,” the complaint alleges, AHI “has also purposefully maintained secret the specific vulnerabilities and root causes of the Data Breach and has not informed Plaintiff and Class Members of that information.”

The complaint alleges that the company “did not use reasonable security practices appropriate to the nature of the sensitive, unencrypted information [it was] maintaining…” It offers several lists of measures that can be taken to avoid data breaches, as recommended by the US government, the United States Cybersecurity & Infrastructure Security Agency, and the Microsoft Threat Protection Intelligence Team.

The complaint claims AHI “could have prevented this Data Breach by properly securing and encrypting the systems containing the PII…. Alternatively, [AHI] could have destroyed the data, especially for individuals with whom it had not had a relationship past the point of necessity.”

The complaint defines two classes for this action:

• The Nationwide Class is all US residents whose PII was accessed or acquired during the data breach event in the Notice of Data Breach that AHI sent out on or about October 17, 2021.
• The North Dakota Class is all North Dakota residents whose PII was accessed or acquired during the data breach event in the Notice of Data Breach that AHI sent out on or about October 17, 2021.

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Negligence, Your Privacy