More Patient Information Reportedly Compromised

Los Angeles, CAConcerns continue to grow in the wake of the UCLA data breach that UCLA isn’t taking the security of personal information seriously enough. More than 4.5 million patients may have been affected by the data breach, which could have occurred as early as September 2014. Now, patients are learning that a computer with personal information was stolen, putting more people’s information at risk.

According to the Los Angeles Daily News (9/1/15), UCLA Health is warning up to 1,242 patients that their personal information may have been compromised after the laptop of a faculty member was stolen. That laptop reportedly contained names, medical record numbers and health information, but no Social Security numbers, health plan ID numbers or financial data. The computer was reported stolen on July 3.

This is the second data breach in recent months for UCLA Health, which also faces lawsuits following a cyber attack on its computer systems. That cyber attack made the personal information of approximately 4.5 million people vulnerable, although UCLA Health has said there was no information that personal or medical information was accessed. Included in the compromised information were names, addresses, birth dates, Social Security numbers and other confidential information.

UCLA Health has come under fire for its handling of the massive data breach. Although UCLA became aware of a potential cyber hack in October 2014, patients were not warned about the breach until July 2015.

A proposed class-action lawsuit has been filed against UCLA Health System, alleging UCLA didn’t properly protect personal information and then waited too long to inform patients about the breach. The lawsuit alleges violations of California’s Customer Records Act, Confidentiality of Medical Information Act and other laws. The lawsuit was filed by Miguel Ortiz and seeks to represent current and former UCLA patients living in California whose personal information was compromised.

UCLA has offered 12 months of identity theft recovery and restoration for free, although critics say that coverage is not nearly enough for people who have their identities stolen.

The UCLA lawsuit is Ortiz v. UCLA Health System et al., case number BC589327, in the Superior Court of the State of California, County of Los Angeles.

A different lawsuit has also reportedly been filed by Michael Allen in California federal court, alleging UCLA failed to adequately secure and protect confidential information. That lawsuit also seeks class-action status and damages for breach of contract and unlawful business practices. The lawsuit is Allen v. UCLA Health Systems Auxiliary et al, case no. 2:15-cv-05487, in the US District Court for the Central District of California.