Class Action Claims Lubbock Heart & Surgical Hospital to Blame for 2022 Data Breach

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action claims Lubbock Heart & Surgical Hospital’s failure to implement adequate cybersecurity measures is to blame for a July 2022 data breach that affected at least 23,379 current and former patients.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 32-page case relays that an unauthorized party breached Lubbock Heart & Surgical Hospital’s network for two days beginning on July 11 of last year and was able to access patients’ sensitive personal and health information. According to the suit, the Texas-based hospital made itself an “easy target” for hackers by maintaining “no effective means to prevent, detect, stop, or mitigate breaches of its systems.”

The complaint alleges the breach compromised current and former patients’ names; dates of birth; contact and demographic information; Social Security and medical record numbers; diagnosis, treatment, prescription and health insurance information; provider names and dates of service.

Although Lubbock Heart & Surgical Hospital claims to have since enhanced its cybersecurity safeguards, its efforts are “too little too late,” the lawsuit contends, especially since the hospital’s privacy policy recognized its legal obligation to adequately protect patient information long before the cyberattack transpired.

Moreover, the complaint stresses that the hospital’s alleged negligence has exposed affected individuals to a significant risk of identity theft and fraud as their private information will likely be traded on the black market. Lubbock Heart & Surgical Hospital has made a weak attempt to remedy this risk by offering complimentary credit monitoring and identity protection services only to victims whose Social Security numbers were leaked during the incident, the case says.

Per the filing, the hospital waited two months to notify affected individuals of the incident, depriving them of any timely efforts to mitigate damages.

“Further, the Defendant’s ‘Notice of a Data Security Incident’ shows that Defendant cannot—or will not—determine the full scope of the Data Breach, as Defendant has been unable to determine precisely what information was stolen and when,” the suit reads.

As the complaint contends, Lubbock Heart & Surgical Hospital’s deficient cybersecurity measures were particularly negligent considering that data breaches have, in recent years, become a notorious threat to companies that store sensitive data, and their risks are widely known.

The lawsuit looks to cover anyone in the United States whose personally identifiable information and protected health information was compromised in the data breach discovered by Lubbock Heart & Surgical Hospital in July 2022.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.