Lawsuits: Patients ‘Harmed’ by Scripps Health Cyberattack

As of Monday, four class action lawsuits related to the ransomware incident had been filed – all in California – against San Diego-based Scripps Health. Two of the lawsuits were filed in state court and two in federal court. Among the claims, the lawsuits allege Scripps Health failed to comply with a variety of state and federal laws and regulations related to protecting personal and medical privacy, including the California Confidentiality of Medical Information Act, Federal Trade Commission unfair trade practice regulations and the HIPAA privacy and security rules. “[Scripps Health’s] misconduct – failing to timely implement adequate and reasonable measures to protect Plaintiff’s Personal and Medical Information, failing to timely detect the Data Breach, failing to take adequate steps to prevent and stop the Data Breach, failing to disclose the material facts that they did not have adequate security practices in place to safeguard the Personal and Medical Information, and failing to honor their promises and representations to protect Plaintiff’s and Class members’ Personal and Medical Information – caused substantial harm and injuries to Plaintiff and Class members across the U.S.,” alleges a proposed class action lawsuit filed June 21 in a California federal court by Scripps Health patient Kate Rasmuzzen.