A class-action lawsuit has been filed against Cottage Health System, claiming that the confidential information of more than 32,000 patients was put online for anyone to read, and was public for almost two months before the hospital system noticed.
The 15-page complaint states that between Oct. 8 and Dec. 2 of 2013, the confidential medical records of about 32,500 patients affiliated with Cottage Health System were negligently disclosed and released to the public on the Internet.
The records could be seen by anyone for that span of two months, the complaint states, adding that the "extent of the breach is enormous."
A statement from Cottage Hospital System said it takes its obligation to protect patient health information very seriously.
"We have notified the patients involved in the recent data disclosure, and will continue to investigate the unique circumstances that led to this event," the statement said, but added that Cottage is unable to comment on an active lawsuit.
The case includes former patient Kenneth Rice and others who had their records revealed, and is against the corporation inSync, a Laguna Hills-based company responsible for putting the records in a secure location online, and Cottage Health System, which has hospitals in Santa Barbara, Goleta and Santa Ynez.
The affected records are from people who attended any of Cottage's hospitals from Sept. 29, 2009, to Dec. 2, 2013.
Rice sought treatment at Cottage Hospital on multiple occasions, and provided the hospital with confidential information but never authorized the release of that information.
The complaint alleges that inSync "failed to provide any encryption or other security to prevent anyone from reading the medical records."
On Dec. 2, Cottage was contacted by a third party, who informed it that he was able to read the confidential records of patients online.
"How was it possible that the medical records could be placed in the public domain of the Internet, for anyone to view for two months, without Cottage Hospital detecting that anyone surfing the Internet could view the confidential medical record of 32,500 of its patients? The only answer is that Cottage Health was completely negligent in its obligations under the CMIA and HIPAA," the lawsuit states.
Rice received a letter on Dec. 6 stating that his confidential records had ended up on the Internet.
The case was filed in Orange County Superior Court on Jan. 27 by L.A.-based attorney Brian Kabatek and Don Ernst of Ernst Law Group APC in San Luis Obispo.
The complaint asks for a jury trial and at least $1,000 in damages per class member.