New Mexico Hospital Sued Over Patient Data Breach

A New Mexico woman is suing a hospital and its parent company after hackers accessed personal information belonging to her and more than 4 million other patients, the Albuquerque Journal reported Saturday.

Attorneys for Briana Brito said they were seeking class-action status for the lawsuit.

The suit, which was filed Sept. 19, alleges Brito had personal data stolen while hospitalized at Alta Vista Regional Hospital in Las Vegas. According to Brito, the Franklin, Tennessee-based Community Health Systems, which owns the hospital, didn’t notify patients in a timely manner. She “now faces a substantial increased risk of identity theft, if not actual identity theft,” the suit said.

The suit is requesting a judge order the company pay restitution for any losses from identity theft, consumer credit protection and insurance.

Tomi Galin, company spokeswoman, declined to comment on Friday. In a written statement, Galin said the firm does not discuss pending litigation.

Community Health Systems disclosed in August that the company had been the victim of a cyberattack that came from a group in China that used sophisticated malware and technology to obtain information. The company said the attack may have happened in April and June. No medical or credit card records were taken, the company said.

However, hackers managed to bypass security systems to take patient names, addresses, birthdates and phone and Social Security numbers. Community Health has since removed the malware from its system and finalized “other remediation efforts” to prevent future attacks.

The information that was taken came from patients who were referred to or received care from doctors tied to the company over the past five years.

Community Health owns, leases or operates 206 hospitals in 29 states. In New Mexico, the company oversees five other facilities.

Brito’s attorneys plan to join another lawsuit out of Texas.