The Arkansas attorney general filed a lawsuit March 17 against a defunct hospital accusing it of failing to protect sensitive patient information after it closed.
Cherokee Village, Ark.-based Eastern Ozarks Regional Health, which permanently closed in December 2004, is accused of leaving behind thousands of unsecured patient and employee records that included Social Security numbers, driver's license numbers, account information, medical information and biometric data.
An inspection of the property by the office of the attorney general identified that many of the files appeared to have been examined by unauthorized individuals.
At this stage, it is unclear how many files there are and how many former patients and employees of the facility have had their sensitive data exposed and potentially stolen.
The suit alleges that the former hospital violated the Personal Information Protection Act and the Arkansas Deceptive Trade Practices Act due to its failure to properly dispose or secure documents prior to the properties being taken over by the state of Arkansas.
The hospital and its owners face civil penalties up to $10,000 for each violation of the PIPA and the ADTPA.