Chicago-based CommonSpirit Health has been hit with a proposed class-action lawsuit over the recent ransomware attack on the health system.
The complaint was filed Dec. 29 in U.S. District Court for the Northern District of Illinois by Leeroy Perkins, of Washington, a patient since 2003 at Seattle-based Virginia Mason Franciscan Health, a subsidiary of CommonSpirit.
He was among the 623,774 patients notified in December that their data had been breached in the cyberattack against CommonSpirit, which started in September and caused widespread EHR outages and appointment cancellations.
The lawsuit claims CommonSpirit failed to "implement and follow basic security procedures" and "follow its own policies" to safeguard patients' personally identifiable and protected health information, leaving them vulnerable to identity theft.
The complainant asked for class-action status as well as damages, restitution and other forms of equitable monetary relief, and declaratory and injunctive relief.
A CommonSpirit spokesperson said the health system is unable to comment at this time.