A patient of Health Quest is suing the Lagrangeville, N.Y.-based health system for allegedly failing to safeguard her protected health information after it was exposed in a phishing attack, according to the Poughkeepsie Journal.
Nuvance Health, which acquired Health Quest last year, is also listed as a defendant in the lawsuit, which was filed Jan. 21. In 2018, Health Quest was the victim of a phishing incident that resulted in several employees disclosing their usernames and passwords to unauthorized third parties.
After an investigation, Health Quest began notifying patients in May 2019 of the incident. However, Health Quest mailed additional patients in January 2019, saying that their information may have also been exposed in the 2018 phishing attack. In total, around 28,910 patients may have been affected, reports the Poughkeepsie Journal.
Patient data that may have been exposed included names, dates of birth, Social Security numbers, Medicare claim numbers, driver's license numbers, provider names, dates of treatment, treatment and diagnosis information, health insurance plan member and group numbers, health insurance claims information, financial account information with security codes, and payment care information.
"Defendants' security failures enabled the hackers to steal the private information of plaintiff and members of the class…These failures put the plaintiff's and class members' private information and interests at serious, immediate and ongoing risk and, additionally, caused costs and expenses," the lawsuit says, according to the Poughkeepsie Journal.
Nuvance Health declined to comment, saying they don't comment on pending litigation. The patient is seeking financial damages.