{"id":313093,"date":"2024-06-08T08:45:06","date_gmt":"2024-06-08T13:45:06","guid":{"rendered":"https:\/\/www.liveaction.org\/news\/?p=313093"},"modified":"2024-06-06T09:06:59","modified_gmt":"2024-06-06T14:06:59","slug":"planned-parenthood-los-angeles-6m-data-breach","status":"publish","type":"post","link":"https:\/\/archive.liveaction.org\/news\/planned-parenthood-los-angeles-6m-data-breach\/","title":{"rendered":"Planned Parenthood Los Angeles pays $6M settlement over data breach"},"content":{"rendered":"
<\/div>

Planned Parenthood Los Angeles (PPLA) has reached a “$6 million settlement to resolve all claims related to a 2021 data breach<\/a> that exposed the personal information of more than 409,437 patients,” reported the HIPAA Journal<\/a> in April.<\/p>\n

The data breach<\/a> was blamed on a ransomware attack, according a report<\/a> by the Los Angeles Times.<\/p>\n

\"Planned

Planned Parenthood Los Angeles data breach $6 million settlement<\/p><\/div>\n

In an\u00a0email alert<\/a> sent to its clients, PPLA indicated that on October 17, PPLA\u00a0identified<\/a> \u201csuspicious activity\u201d on its \u201ccomputer network,\u201d as Live Action News previously<\/a> reported. Planned Parenthood then claimed it immediately took its \u201csystems offline, notified law enforcement, and a third-party cybersecurity firm was engaged to assist in our investigation.\u201d<\/p>\n

The investigation determined that \u201can unauthorized person gained access to our network between October 9, 2021 and October 17, 2021, and exfiltrated some files from our systems during that time,\u201d according to PPLA, which later\u00a0concluded<\/a>\u00a0that the files which were involved contained patient names,\u00a0insurance information, dates of birth, and \u201cclinical information, such as diagnosis, procedure, and\/or prescription information.\u201d<\/p>\n

“The covered entity (CE), Planned Parenthood Los Angeles, reported that it experienced a ransomware attack that compromised the protected health information (PHI) of 409,759 individuals. The PHI involved included names, addresses, dates of birth, Social Security numbers, diagnoses\/conditions, lab results, medications prescribed, and health insurance information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In response to the breach the CE strengthened its administrative and technical safeguards,” the archived Office for Civil Rights (OCR) notification<\/a> stated.<\/p>\n

CLASS ACTION LAWSUIT<\/strong><\/p>\n

Shortly after receiving the notice of the breach, a class action lawsuit was filed against Planned Parenthood in the U.S. District Court of Central California.<\/p>\n

The lawsuit alleged “violations of the Health Insurance Portability and Accountability Act (HIPAA), the California Confidentiality of Medical Information Act (CMIA), and the California Consumer Privacy Act (CCPA),” according to the HIPAA Journal.<\/p>\n

In addition, the lawsuit<\/a>\u00a0claimed that “Despite discovering the Data Breach on October 17, 2021 (more than one week after the unauthorized parties first accessed PPLA\u2019s systems), not until November 4, 2021, did PPLA determine that the stolen files included its patients\u2019 Confidential Information. And, PPLA failed to provide notice to its patients until November 30, 2021, at the earliest\u2014more than one month after PPLA had detected the Data Breach<\/strong>” (emphasis added).<\/p>\n

PPLA’s client claimed to have suffered from “stress and anxiety as a result of the Data Breach and from the loss of her privacy” and “a present injury from the existing and continuing risk of fraud, identity theft, and misuse resulting from her personal information… being placed in the hands of unauthorized third parties,” the lawsuit stated.<\/p>\n

Multiple Plaintiffs also claimed in the suit that they “would not have used PPLA had [they] known that it would expose, or allow to be exposed, [their] Confidential Information, making it available to unauthorized parties.”<\/p>\n

PLANNED PARENTHOOD LOS ANGELES $6 MILLION SETTLEMENT<\/strong><\/p>\n

While, according to HIPAA Journal, PPLA chose to settle the lawsuit with no admission of wrongdoing, the plaintiffs allege that Planned Parenthood “acted in reckless disregard of their privacy rights” and “knew or should have known that their substandard data security measures are highly offensive to a reasonable person in the same position as Plaintiffs and Class members.”<\/p>\n

As a result of the lawsuit, a $6 million fund has been set up to confer statutory damages, HIPAA Journal claimed.<\/p>\n

\"Planned

Planned Parenthood privacy breach $6 million settlement<\/p><\/div>\n

According to the settlement<\/a>, PPLA clients who “received a notice from PPLA in or around November 2021 about the Data Breach… are included in this Settlement as a ‘Settlement Class Member.’\u201d<\/p>\n

“Under the Settlement<\/a>, PPLA has agreed to establish a Settlement Fund to pay for (1) credit monitoring and identity theft protection and insurance; (2) a cash Statutory Payment for claims brought under the California Confidentiality of Medical Information Act, Cal. Civ. Code \u00a7 56\u00a0et seq.;<\/i> (3) a cash payment of up to $210 for up to an additional seven hours of documented time fairly traceable to the Data Breach, valued at $30 per hour; (4) cash payment of up to $10,000 for documented losses and\/or out-of-pocket costs fairly traceable to the Data Breach; and (5) the costs of the settlement administration, court-approved attorneys\u2019 fees and expenses, and service awards for Class Representatives,” the Litigation Settlement website<\/a> reads.<\/p>\n

Claims can be made at this website<\/a> and “will be accepted up to a maximum of $10,000 to recover documented losses,” HIPAA Journal wrote.<\/p>\n

But “Claims must be filed on or before July 6, 2024,” PPLA’s notice from the courts<\/a> stated.<\/p>\n