MARYLAND (WBFF) — As Luminis Health continues working to restore systems disrupted for weeks by a cyberattack, the health network is now facing a proposed class action lawsuit from patients who say their private information may have been compromised.
Three patients have joined the lawsuit, which was filed in federal court. The complaint accuses Luminis of failing to adequately safeguard patients’ private information and alleges sensitive patient data was stored in an “unencrypted, Internet-accessible environment.” The lawsuit argues those affected now face an increased risk of identity theft, fraud and loss of medical privacy.
UMBC Cybersecurity Institute Director Anupam Joshi said the patients will need to show not only that their information was accessed, but that the breach caused actual harm. Joshi also said it is not clear what the attacker’s intent was.
“So, who knows what the criminal has in mind? So, it could be exfiltrating data. They could just be shutting down systems. They could be doing ransomware. It’s like we can speculate wildly,” Joshi said.
Luminis Health declined an interview but provided a statement saying the system that stores and hosts patient records was not affected.
“The recent cyber incident did not affect the system that stores/hosts our patient records,” the statement said.
The health system also said it will notify patients if the investigation finds protected information was impacted.
“We will notify patients if the investigation determines that protected information was impacted,” the statement said.
Joshi noted that if patient data is lost, federal health privacy rules can require reporting, and he said the notification deadline can be up to 60 days. He also warned that cyberattacks against health care organizations are becoming more common as criminals target sensitive data and money.
“Now, I do believe that if patient data is lost, HIPAA has certain reporting requirements,” Joshi said. “They tend to go after where money is, and healthcare has money and you know data that is sensitive.”
Luminis Health has said on its website that phone lines are back online, but its patient portal remains down, continuing to delay some elective care and preventing some test results from being accessed. There is still no timeline for when systems will be fully restored, and there has been no word on who was behind the attack.
Local Story
