UnitedHealth Group and its Change Healthcare business are facing a proposed class-action lawsuit in the wake of a cyberattack that downed Change's applications, complicating operations at hospitals, physician practices and pharmacies.
The lawsuit was filed March 4 on behalf of a California resident who fills his medical prescriptions at a local CVS Pharmacy that uses the Change Healthcare platform.
"Born out of UHG's negligence, patients and healthcare providers alike will feel the immediate effects of the network outage for some time," the lawsuit filed in Minnesota federal court alleges. "And to make it worse, patients who had their PHI stolen will feel the sting of this Data Breach for their lifetime. All the while, Defendants continue to rake in billions of dollars off the backs of the patients and providers whose confidential and highly sensitive information they promised to protect."
UnitedHealth Group said Change was hit by BlackCat ransomware group Feb. 21, forcing its systems offline. The claims processing and revenue cycle management platform is still working to restore functionality, and UnitedHealth Group asked health systems to use alternative methods for claims processing while its systems are down. BlackCat claimed it stole 6 terabytes of data from Change, including medical records and Social Security numbers.
The lawsuit argues that UnitedHealth Group is responsible for the data breach because it "failed to implement reasonable security procedures and practices and failed to disclose material facts surrounding its deficient security protocols."
"As a result of UHG's failure to protect the sensitive information it was entrusted to safeguard, Plaintiff and Class members did not receive the benefit of their bargain with UHG and now face a significant risk of medical-related theft and fraud, financial fraud, and other identity-related fraud now and into the indefinite future," the lawsuit alleges.
Among other things, the lawsuit seeks compensatory, consequential and general damages for class members, including nominal damages as appropriate for each count as allowed by law in an amount to be determined at trial. It is also asking the court to award statutory damages, trebled, and/or punitive or exemplary damages, to the extent permitted by law.
The suit is also seeking the court to order "disgorgement and restitution of all earnings, profits, compensation, and benefits received by UHG as a result of their unlawful acts, omissions, and practices."
A UnitedHealth Group spokesperson declined to comment on the specifics of the lawsuit but told Becker's that the company is "focused on the investigation and recovery of Change Healthcare's operations."