A woman is suing SuperCare Health for inadequate cybersecurity protocols after a breach of 318,000 patient files last year, according to HIPAA Journal.
The lawsuit was filed in federal court April 12 against the Downey-Calif.-based respiratory care provider after the breach was reported to patients March 25. The provider said there was exposure in July 2021 and potential theft of patient names, addresses, birthdates, account numbers, medical record numbers, health insurance information, and testing, diagnostic, treatment and claims information. Some patients also had their Social Security and driver's license numbers exposed.
SuperCare Health offered credit monitoring and identity theft protection services to those affected and reported the incident to HHS on March 28.
The lawsuit alleges that SuperCare Health did not have adequate and reasonable cybersecurity procedures and protocols to secure patient health information, including not notifying patients until six months after the breach was noticed. The lawsuit also claims that SuperCare did not follow security guidelines and standards of the National Institute of Standards and Technology and Federal Trade Commission. The suit claims the provider also violated HIPAA and other state laws, according to HIPAA Journal.
The plaintiff says she was not offered adequate credit monitoring, identity theft protection services or appropriate compensation for the breach. She claims injuries from the breach damaged the value of her private information and increased her risk of identity theft and fraud.
The plaintiff is seeking a class-action certification, a jury trial, an award of damages, reimbursement for out-of-pocket costs and a lifetime of credit monitoring services. She also wants SuperCare to improve its cybersecurity systems and work with future annual security audits.