LOS ANGELES (CN) - A flash drive holding the confidential medical records of almost 49,000 Kaiser patients was stolen, exposing their names and other information, a class claims in a lawsuit filed in Los Angeles County Central District Court.
Ginger Buck brought a class action against Kaiser Permanente International under California's Confidentiality of Medical Information Act. Under the act, medical facilities must keep patient information confidential unless the patient gives written authorization.
The complaint states, "On or around Dec. 2013, the private medical information of all patients - including plaintiff and the class - who had treated at Kaiser Permanente had been stolen," specifically, a computer flash drive containing the medical information of almost 49,000 patients was gone.
Kaiser acknowledged that private data of 49,000 patients was on a flash drive that had gone missing, in a data breach notification letter to patients that Courthouse News acquired from technology news site CRN.
Kaiser's letter said that the flash drive contained each patient's name, medical record number and birth date.
The alleged breach occurred at Anaheim Medical Center's hospital's nuclear medicine department, Kaiser told the Los Angeles Times. Each file listed the type and amount of a specific medication, the Times said.
Buck says she was treated at Kaiser sometime before 1998. "At the time of her visit, plaintiff provided confidential medical information to Kaiser, including her name, personal information and hospital account number. At no time during her visit did plaintiff provide written authorization that her private medical information be disclosed," according to the complaint.
"Plaintiff's claims are typical of the claims of the class. Plaintiff is a member of the class she seeks to represent," the complaint states. It also states that plaintiff seeks to represent "all persons who were treated in Kaiser Permanente and/or its medical centers."
Plaintiff seeks $1,000 per class member;penalties available to the class as provided by the California Civil Code; general, special and consequential damages; and interest and attorney's fees. The class is represented by Byron T. Ball of The Ball Law Firm.
According to another data breach notification letter, dated Sept. 10, Kaiser acknowledged that a similar breach occurred May 16, when a Kaiser employee attached a document regarding a "wellness screening competition" to an outside source, not realizing it contained private information along with a summary of the competition information.
Read the Top 8
Sign up for the Top 8, a roundup of the day's top stories delivered directly to your inbox Monday through Friday.