Four Patients Sue DCH Health System After Ransomware Attack

Four patients filed a lawsuit against DCH Health System after a ransomware attack shut down DCH Health System’s three hospitals to all but critical patients and exposed patients’ private information.

The four patients filed suit against DCH Healthcare Authority d/b/a DCH Health System in the United States District Court for the Northern District of Alabama Western Division on December 23, 2019.

In the complaint, the patients asserted claims for negligence, an intrusion upon seclusion, negligence per se, breach of express contract, breach of implied contract, and breach of fiduciary duty. The patients also alleged that DCH Health System violated federal medical privacy laws when the ransomware attacker gained access to their medical records and billing information.

In the lawsuit, plaintiff-patient Geraldine Daniels alleged “As a post-surgical patient at DCH, she suffered severe pain and couldn’t get the medications that were prescribed to her during her stay for numerous hours after her surgery.”

Sheneka Frieson, filed as a plaintiff on behalf of a 7-year-old girl who went to a DCH Health System facility for an allergic reaction that caused the girl’s eyes to swell shut. At the facility, she was told that it would be a four to five hour wait for treatment. Her other options were to drive to Walgreens for medications or drive to Birmingham for treatment. She alleged that “as a consequence of this disruption to her medical care,” it took three days for the girl’s swelling to go down.

Prior to the ransomware attack, plaintiff Kimberly Turner received X-rays and medical treatment at a DCH Health System facility. She alleged that “During the Ransomware attack, all her medical document files were lost or inaccessible, and everything that was on file was lost or inaccessible.” She claimed that she had to have new X-rays taken and her medical care was disrupted.

Plaintiff Mary Williams claimed that her “medical records were compromised, and her medical care disrupted as a direct and proximate result of the Ransomware Attack.”

When the attack occurred DCH Health System reported “Early Oct. 1, the DCH Health System discovered that it had suffered a ransomware attack that impacted their systems. We immediately implemented emergency procedures to continue providing safe and patient-centered care. While the attack has impacted DCH’s ability to accept new patients, we are still able to provide critical medical services to those who need it. Patients who have non-emergency medical needs are encouraged to seek assistance from other providers while DCH works to restore its systems.”

It took DCH Health System over a week to restore their systems and hospitals to full functionality. On October 5, 2019 DCH Health System reported “we have obtained a decryption key from the attacker to restore access to locked systems.”

Is suing health systems after a data breach the newest trend? For OTW’s coverage of a recent data breach lawsuit, see “Victims Can Sue Ortho Clinics if Data Hacked.”