Harvard Pilgrim Healthcare sued for data breach

Several of the lawsuits accuse Harvard Pilgrim Health Care and its parent company Point32Health of “willful failure” to meet its responsibilities to protect personally identifiable information and protected health information.

why it matters

Lawyers for Valeria Salerno Gonzales, a member of HPHC, filed a four-count, 32-page lawsuit in a Massachusetts court against HPHC and Point32Health for a jury trial, alleging damages and future damages to the health insurer’s 2.5 million members Has gone. report on tuesday harvard crimson,

Salerno Gonzalez v. Harvard Pilgrim Health Care Inc. et al Alleges HPHC’s “reckless and grossly negligent” approach to perceived risks and known hazards.

The lawsuit reads, “Defendants’ grossly negligent conduct has caused damages as an proximate and proximate result to Plaintiffs and members of the class and are at imminent risk of additional damages and damages.”

Additional lawsuits accuse HPHC of violating HIPAA safeguards rule HIPAA Journal informed of.

Tracy Wilson v. Harvard Pilgrim Health Care, Inc. and Point32Health, Inc. Alleges damages based on delay – the time it took for defendants to discover and report the infringement.

Plaintiffs reported an increase in spam texts and calls as well as anxiety, stress, sleep disruption and fear following the breach, according to the story.

On June 8, Point32Health posted a system update stating that providers should continue to provide care to HPHC members and that services would be covered.

“We have made significant progress in getting our systems back online and processing various business transactions,” Point32Health spokeswoman Kathleen Makela said in a statement to Harvard University Publications.

She reportedly said that information sharing with partners has resumed and that more core functions will be back online in the coming weeks.

“Our primary focus during the recovery is to ensure that members and our clients receive care and services as quickly and safely as possible.”

HPHC, founded by a former dean of Harvard Medical School, is not part of Harvard University. Crimson They say.

When the insurer went into receivership in 2000 with the appointment of now-former Massachusetts governor Charlie Baker as receiver, the state sued the university for naming Harvard after itself. Point32Health was formed when HPHC merged with Tufts Health Plan in 2021.

big trend

In May, Point32Health confirmed a health data breach involving HPHC — data was copied and taken from the healthcare payer’s systems during a cyberattack that occurred between March 28 and April 17.

HPHC, which has members in Massachusetts, New Hampshire, Maine and Connecticut, said the excluded data included names, physical addresses, phone numbers, dates of birth, health insurance account information, Social Security numbers, provider taxpayer identification numbers and clinical information. Information may be included.

Providers are targeted by cybercriminals, but cybersecurity experts are calling for the entire healthcare ecosystem, including payers and pharma, to work together, according to Greg Conti, principal at Copidion and trainer at Black Hat for nearly nine years.

“Detecting and mitigating attacks early in the killing chain can prevent attacks before we feel the effects,” he said. Healthcare IT News,

“Sharing threat information and creating visibility and situational awareness for not only an individual company but the healthcare industry, will allow you to see attacker activity earlier and take appropriate measures.”

On the record

“Our systems recovery efforts are focused on priority areas of the business, such as eligibility and enrollment; Continuity of care, access management and prior authorizations; provider payment; claims processing for medical and behavioral health; Sales and Renovations and remaining business functions,” Makela reportedly said in a statement.

Andrea Fox is a senior editor for Healthcare IT News.
Email: afox@himss.org
Healthcare IT News is a HIMSS Media publication.