BioPlus Specialty Pharmacy Negligence and Data Breach Class Action

BioPlus Specialty Pharmacy Services, LLC is a specialty pharmacy that offers products and services for people with cancer, infusion, multiple sclerosis, hepatitis C, and other complex or chronic conditions. As such, it maintains a great deal of personally identifiable information (PII) and protected health information (PHI) on its customers. This class action concerns BioPlus’s recent data breach, which the complaint alleges affected roughly 350,000 current and former patients.

The class for this action is all persons who live in the US whose PII and PHI were compromised in the data breach.

BioPlus noticed suspicious activity in its network around November 11, 2021, the complaint alleges, later finding that unauthorized parties had had access to its systems between October 25 and November 11, 2021. BioPlus did not begin notifying customers of the data breach until around December 10, 2021.

Among the information exposed in the data breach were names, addresses, dates of birth, Social Security numbers, health plan member ID numbers, diagnoses, and prescription information.

The complaint alleges that BioPlus bears at least some responsibility for the exposure of customer information because of its failures, including, the complaint claims, its “failure to implement and maintain reasonable data security safeguards, failure to exercise reasonable care in the hiring and supervision of its employees and agents, and failure to comply with industry-standard data security practices as well as federal and state laws and regulations” about information security and privacy.

According to the complaint, BioPlus “failed to recognize and detect unauthorized third parties accessing its network, and failed to recognize the substantial amounts of data that had been compromised. Had [BioPlus properly maintained and monitored its information technology infrastructure, it would have discovered the invasion sooner—and/or prevented it altogether.”

Among the damages to the victims of the data breach in this case, the complaint names the following:

• Theft of their PII and PHI
• Costs associated with the detection and prevention of identity theft
• Costs of lost time and diminished productivity from dealing with the consequences of the data breach
• Invasion of privacy
• Emotional stress, distress, nuisance, and annoyance
• Injuries arising from fraud or identity theft

According to the complaint, one of the plaintiffs in this case has “spent approximately 2 hours speaking with his bank regarding six fraudulent charges on his credit report for accounts he did not open, totaling about $300-$400, that occurred following the Data Breach.”

The complaint alleges that BioPlus should have informed the victims whose information was stolen sooner than it did.

The counts include negligence and negligence per se.

Article Type: Lawsuit
Topic: Privacy
Tags: Exposing Private Information, Exposure to cyber crime, Your Privacy