Chambersburg, Pa.-based Keystone Health, a primary care provider, is facing a class action lawsuit for allegedly failing to prevent a data breach that compromised the protected health information of 235,237 patients.
The complaint claims that Keystone Health failed to implement adequate cybersecurity measures and that it didn't properly notify patients of the breach.
The breach, which occurred between July 28 and August 19, allowed hackers to gain access to its network and compromise Social Security numbers and clinical health information of 235,237 patients.
The plaintiffs alleged that Keystone detected the cyberattack on August 19 but waited until October 14 to notify affected individuals.
The lawsuit alleges that because of this, Keystone violated its obligations under HIPAA and overlooked minimum industry standards for cybersecurity.