Pennsylvania Health System Agrees to $65 Million Settlement in Hack that Exposed Nude Photographs of Cancer Patients
On September 23rd, 2024, CNN reported that a health care system in Pennsylvania has agreed to pay approximately $65 million to resolve a class action lawsuit. The case centered around a terrible data breach in 2023 that resulted in hackers posting nude photographs of cancer patients on the internet. At Saltz Mongeluzzi Bendesky P.C., our firm represented plaintiffs in the class action case. Here, you will find a more detailed overview of the case and the settlement agreement.
Data Breach Led to Serious Privacy Violations for Cancer Patients
In February of 2023, the Lehigh Valley Health Network (LVHN)—a healthcare network based in Allentown, PA that is now part of Jefferson Health—was the subject to a major ransomware attack. Sadly, avoidable cybersecurity failures by the entity resulted in very serious privacy violations. More specifically, hackers infiltrated the network supporting a physician practice in Lackawanna County. The hackers accessed and stole sensitive patient data, including nude photos of cancer patients who were undergoing treatment.
A ransomware attack is a type of cyberattack where malicious software encrypts data and renders it inaccessible until a ransom is paid. The attacker usually demands payment in exchange for the decryption key needed to unlock the data. In this case, LVHN refused to make any ransom payment to the hackers. The hackers retaliated by releasing the nude photos of the cancer patients for the public to see on the internet. The data breach not only compromised sensitive personal medical information, it caused profound embarrassment and humiliation for the affected patients.
Patient Medical Records are Sensitive
Patient medical records are highly sensitive data. They contain confidential information, such as personal identification details, medical histories, diagnoses, treatments, and, in some cases, sensitive images such as nude photographs taken for medical purposes. These records are strictly protected by the law, including the federal Health Insurance Portability and Accountability Act (HIPAA). The law was put in place to establish national standards for the protection of medical records and personal health information. HIPAA mandates that medical providers implement robust security measures to ensure the confidentiality, integrity of electronic protected health information.
Class Action Lawsuit: Lehigh Valley Health Network, Inc Failed its Patients
Following the cyberattack, our law firm filed a class action lawsuit against the Lehigh Valley Health Network, Inc. (Jane Doe v. Lehigh Valley Health Network, Inc.) The class action claim was filed in April of 2023 in the United States District Court for the Middle District of Pennsylvania. The lawsuit was brought on the grounds that the health system failed to adequately protect its patients’ sensitive information. Indeed, the lawsuit represented Pennsylvania women whose nude photos were posted online due to the data breach. They were forced to endure severe emotional distress, embarrassment, and humiliation because of the negligence of LVHN. Health care providers must be held accountable for security breaches that expose sensitive patient medical records.
The Largest Per-Patient Compensation for Victims of a Cyberattack
As CNN noted in its reporting, this class action settlement resulted in the largest per-patient compensation of its kind. Lehigh Valley Health Network agreed to pay $65 million to the affected victims. The settlement, which still requires approval from a federal judge, sets aside 80 percent of the total compensation for the victims whose nude photos were published online. The large class action settlement reflects the gravity of the privacy violations suffered by the patients.
Class Action Litigation Allows Victims to Join Together to Get Justice and Accountability
A class action lawsuit can be a very powerful tool for people to join together and seek justice and accountability. Indeed, class action litigation empowers those who sustained harm to unite and pursue legal action collectively against a common defendant. The approach is particularly effective when individual claims might be too small to litigate independently but collectively represent significant wrongdoing. By joining together, victims can pool resources, share legal expenses, and enhance their bargaining power to seek justice and accountability.
A court will not automatically allow a class action lawsuit to move forward. For a class action to be certified, a number of different criteria must be satisfied. For federal claims, class action certification is governed by Rule 23 of the Federal Rules of Civil Procedure. For Pennsylvania state claims, the relevant regulation for class action certification is Rule 1702 of the Pennsylvania Rules of Civil Procedure. Under both, a plaintiff initiating a class action generally needs to proof:
- The proposed class is sufficiently large;
- Class members have common claims;
- The representative plaintiff’s claim is typical; and
- The representative plaintiff will fairly represent all class members.
In the class action lawsuit against Lehigh Valley Health Network, a significant number of people had common claims against the health system. They were subject to similar privacy violations when they had their sensitive, nude photographs hacked and published on the internet.
Attorneys Patrick Howard and Simon B. Paris Represented Plaintiffs
At Saltz Mongeluzzi Bendesky P.C., we are proud to have fought for justice for victims in this case. Attorneys Patrick Howard and Simon B. Paris—both partners are our firm—represented plaintiffs in the class action lawsuit against Lehigh Valley Health Network, Inc. Our firm has extensive experience handling complex class action claims. We put the rights and interests of people and families first. Justice and accountability are a must. Our primary mission is to provide class action plaintiffs with top-tier, reliable, and personalized legal guidance and support.
Schedule a Free Consultation With Our Class Action Litigation Attorneys Today
At Saltz Mongeluzzi Bendesky P.C., our class action litigation lawyers are committed to providing solutions-focused advocacy to clients. We have the knowledge and experience needed to take on even the most complex of class action cases. Give us a phone call now or contact us online for your free, no obligation initial consultation. With a main office in Philadelphia, our firm represents plaintiffs in class action lawsuits in Pennsylvania and Nationwide.