Retreat Behavioral Health Failed to Protect Private Patient Info from Data Breach, Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action lawsuit accuses Retreat at Lancaster County and Retreat Behavioral Health LLC of failing to protect patients’ personal information from a data breach in July 2022.

According to the 44-page lawsuit, Retreat Behavioral Health (which provides behavioral and mental health services at locations in Florida, Pennsylvania and Connecticut) and its Pennsylvania subsidiary Retreat at Lancaster County learned that their computer systems had been accessed by an unauthorized third party in early July. The suit relays that the private information compromised during the ransomware attack included patients’ first and last names, addresses, Social Security numbers, dates of birth and medical and treatment information.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The case alleges that the defendants “careless[ly]” failed to take “adequate and reasonable measures” to secure current and former patients’ personally identifiable information (PII) and protected health information (PHI) against cyberattacks.

“Defendants could have prevented this Data Breach by properly securing and encrypting the folders, files, and or [sic] data fields containing the PII and PHI of Plaintiff and Class Members,” the complaint reads. “Alternatively, Defendants could have destroyed the data they no longer had a reasonable business need to maintain or only stored data in an Internet-accessible environment when there was a reasonable need to do so.”

Additionally, the suit takes issue with the defendants’ alleged failure to notify victims in a timely manner that their private data had been compromised. Though the unauthorized access was discovered in July, the defendants only began notifying those affected in December of last year, the case contends.

“Defendants have also purposefully maintained secret the specific vulnerabilities and root causes of the breach,” the lawsuit adds.

Retreat at Lancaster County and its parent company should have understood that the vast quantity of valuable personal data stored in their network would attract cybercriminals, the complaint charges, and that stringent security measures were required to protect it. 

In fact, by collecting and benefitting from patient data, the companies are legally obligated to safeguard that information, the lawsuit claims.

The consequences of stolen data are “long lasting and severe,” the complaint charges. Per the filing, those impacted by the data breach now face a significant risk of identity theft, tax fraud, and a slew of other illegal schemes.

Retreat Behavioral Health and Retreat at Lancaster County have purportedly offered affected parties two years of credit monitoring, but the lawsuit deems this inadequate as “the fraudulent activity resulting from the Data Breach may not come to light for years.”

Like other current and former patients, the plaintiff, a resident of Maryland, entrusted Retreat at Lancaster County with his personal information in order to obtain its services in 2017, the suit explains. After receiving notice that his information may have been compromised in the 2022 data breach, the plaintiff now suffers “anxiety and increased concerns for the loss of his privacy,” the case claims.

The lawsuit looks to represent anyone identified by the defendants as among those who were affected by the July 2022 data breach, including those who were sent notice of the breach.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.