Lawsuit: KU Health worker accessed records of 400+ patients, including nude photos
KANSAS CITY, Mo. -- A class action lawsuit has been filed after attorneys say a physical therapist with the University of Kansas Health System "unlawfully accessed" files, including "potentially nude clinical photographs," of more than 400 patients who had sought care at a separate Kansas hospital.
The lawsuit was filed Tuesday in U.S. District Court in Kansas City, Kansas, naming KU Health, Lawrence Memorial Hospital, and Epic Systems Corporation as the defendants. It highlights two women -- identified as "Jane Doe #1" and "Jane Doe #2" throughout the suit -- who received letters in 2023, notifying them of the breach.
A spokesperson for KU Health said Wednesday they are reviewing the claims.
According to a Kansas City-based law firm that filed the lawsuit, Stueve Siegel Hanson LLP, the breach started in February 2021 and was not discovered until February 2023. The lawsuit claims the KU Health physical therapist used his employee credentials through Epic's portal to look at the records of at least 425 patients of Plastic Surgery Specialists of Lawrence, an affiliate of LMH, despite having no connection to the patients' care.
The lawsuit, which does not name the physical therapist in question, says he had no affiliation with the Lawrence hospital nor its clinic and had never provided treatment to any of the patients. It claims that the Epic portal permitted patient data sharing between unrelated health systems.
“The violation of privacy suffered by these patients is nothing short of devastating,” said Stueve Siegel Hanson Attorney Austin Moore said in a statement.
“There’s a serious problem in the healthcare industry when an unauthorized employee can access patient records at an unaffiliated medical facility with virtually no oversight. We’re pursuing this case to advocate for stronger safeguards around patient data and to hold accountable those who failed to protect it.”
According to the lawsuit, KU Health sent a letter in April 2023 to the victims, notifying them of the data breach and admitting that an employee had accessed their information "outside of their job duties."
KU Health said in the letter that the employee had been terminated; however, according to the law firm, the letter at the time did not specify what "clinical information" was compromised, "leaving many patients unaware of the full extent of what occurred."
Plaintiffs "Doe #1" and "Doe #2" both indicated in the lawsuit that they received care at LMH between 2021 and 2023, and as part of those procedures, pre-operative and post-operative photos of their nude bodies were gathered and made part of their medical files.
The law firm said its lawsuit asserts negligence claims, invasion of privacy, civil rights violations, and violations of the Computer Fraud and Abuse Act and the Stored Communications Act, among other claims made against KU Health, LMH and Epic.
The lawsuit requests a jury trial and asks the court to award compensatory and punitive damages to the plaintiffs.
In a statement Wednesday, KU Health said: "The University of Kansas Hospital is one of three parties named in a lawsuit alleging violations of patient privacy. We take this seriously; patient privacy is very important to us. We just received the complaint, and our teams are reviewing it currently."
FOX4 has also reached out to Epic and LMH for comment.
Epic has not responded; however, LMH said: "LMH Health was made aware this morning that it is one of three parties named in a lawsuit alleging violations of patient privacy. While we can’t comment on ongoing legal action, we want to reassure our patients and community that we take any suspected violation of patient privacy extremely seriously. This claim is under review by legal counsel, and we will keep the community apprised of any additional facts we can share as they become available.”
A court date has not yet been set in the case.