New Jersey Hospital Operator Faces Class Suit Over Data Breach, Alleged Failure to Notify Patients

A New Jersey health-care provider has been hit with a putative class suit on behalf of patients whose private information was put at risk in a data breach.

Capital Health System, which operates hospitals in Trenton and Hopewell, announced on Nov. 29 that its data network was targeted in a cyberattack, according to the suit filed by Ken Grunfeld of Kopelowitz Ostrow Ferguson Weiselberg Gilbert of Fort Lauderdale, Florida.

Grunfeld, who is in Kopelowitz Ostrow’s Bala Cynwyd, Pennsylvania, office, declined to comment on the filing.

A Capital Health spokesperson said the suit was under review.

Capital Health still has not sent notice letters to victims of the identity theft, according to the suit. It claims that the failure to properly notify victims of the data breach exacerbated their injury by depriving them of the earliest ability to take appropriate measures to protect their private health-care information, and take other steps to mitigate the harm caused by the data breach.

The suit was brought on behalf of a putative class consisting of all individuals in the United States whose private information was compromised in the Capital Health data breach. The plaintiff and class representative, Bruce Graycar, is a longtime Capital Health patient who has had surgeries, emergency room visits and MRIs in the defendant’s facilities, the suit said.

Graycar, the suit said, suffered an actual injury from having his private information compromised in the data breach, including damage and diminution in the value of private information, a form of property that Capital Health acquired from him; violation of privacy rights; and present, imminent and impending injury arising from the increased risk of identity theft and fraud.

The breach could expose Graycar and class members to theft of their personally identifiable information and protected health information, the suit said. Personally identifiable information may include Social Security numbers, which can be used by identity thieves to obtain a driver’s license or an official identification card in the victim’s name but with another person’s photo, the suit said. A Social Security number can also be used to obtain government benefits or file a fraudulent tax return using the victim’s information.

In addition, an identity thief might even give the victim’s Social Security number to police during an arrest, resulting in an arrest warrant being issued in the victim’s name, the suit alleged.

Theft of personal health-care information is particularly serious, the suit said.

“Cyber-criminals can cross-reference two sources of PHI to marry unregulated data available elsewhere to criminally stolen data with an astonishingly complete scope and degree of accuracy in order to assemble complete dossiers on individuals. These dossiers are known as ‘Fullz’ packages,” the suit said.

A “Fullz” package can be sold at a high price to unscrupulous operators such as scam telemarketers, the suit said.

Hospitals have been frequent targets of hackers lately. Two other New Jersey hospitals, Hackensack Meridian Mountainside Medical Center in Glen Ridge and Pascack Valley Medical Center in Westwood, were part of a cyberattack on Thanksgiving Day that impacted dozens of hospitals nationwide, according to published reports. Those facilities are affiliated with Ardent Health Service of Nashville, Tennessee.

Where hospitals are targeted by hackers, class action lawyers have not been far behind. At least 25 class action suits were filed after a data breach in July impacting HCA Healthcare, also of Nashville, which provides health-care services to 180 hospitals and about 2,300 ambulatory care sites.