HealthEC Facing Class Action Following July 2023 Data Breach [UPDATE]

New to ClassAction.org? Read our Newswire Disclaimer

HealthEC faces a proposed class action over a July 2023 data breach that reportedly exposed personal information belonging to almost 4.5 million of its clients’ patients.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 75-page lawsuit says HealthEC, which provides a population health management platform used by healthcare organizations, announced last month that an unauthorized actor hacked its computer systems between July 14 and July 23, 2023.

According to the company’s online notice posted December 22 of last year, the cyberattack compromised current and former patients’ names, addresses, dates of birth, Social Security numbers, taxpayer identification numbers and medical record numbers. In addition, the notice states that the breach exposed individuals’ health insurance information—such as billing and claims details—and certain medical data, including diagnoses, mental/physical conditions, prescription information and provider names and locations.

The full list of affected healthcare organizations can also be found in HealthEC’s notice of the incident.

Per the case, the data breach was a direct result of the defendant’s failure to maintain adequate cybersecurity protocols, such as encrypting sensitive patient data or deleting it when it is no longer needed. The complaint says that data breach victims now face an increased risk of identity theft and fraud due to HealthEC’s alleged negligence in storing their private information.

The suit goes on to allege that the company failed to timely and adequately inform affected individuals of the incident, as it waited until late December 2023 to mail notice letters that lacked key details surrounding the breach.

“Omitted from the notice letter were the date that [HealthEC] detected the data breach, the dates of [the defendant’s] investigation, the details of the root cause of the data breach, the vulnerabilities exploited, and the remedial measures undertaken to ensure such a breach does not occur again,” the filing says. “To date, these critical facts have not been explained or clarified to [the plaintiff] and class members, who retain a vested interest in ensuring that their private information remains protected.”

The lawsuit seeks to cover anyone whose private information was compromised in the data breach announced by HealthEC in December 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.