Case of the Month: Alabama Hospital Lab Settles Data Breach Class Action Suit

Class action lawsuits by patients victimized by data breaches have become increasingly common. And, more often than not, they prove unsuccessful. But a recent case involving Flowers Hospital in Alabama is something of an outlier.

The Case
This long running case began in 2013 when a Flowers Hospital lab employee stole confidential patient information and used the data to file fraudulent tax returns in the victims’ names. The hospital discovered the breach, notified the roughly 1,200 patients potentially affected and fired the employee who was later arrested and sent to jail.

But the response wasn’t enough to keep a group of patients from filing a data breach lawsuit against the hospital’s parent company. The turning point came in March 2017 when the federal district court judge allowed the case to proceed as a class action. That decision completely altered the balance of leverage. Faced with potential liability to an entire class, as opposed to an individual, the parent company had greater incentive to settle.

And that is apparently what has happened. Under the $150,000 settlement agreement, which the judge still needs to approve, each patient filing a claim would get up to $5,000 covering reimbursement for their out-of-pocket crediting costs, four hours of lost wages and interest on delayed tax refunds. Dec. 13 is the deadline for claims filing.

Why the Patients Won
Suing hospitals, labs and other providers for data breaches has not proven a successful litigation strategy. But the claims in this case were different and more compelling:

• Rather than the usual claim of facing increased risks of financial harm, the patients contended they suffered “concrete economic” damages, namely the loss of their tax refunds; and

• The fact that the lab employee confessed also bolstered the patients’ case by enabling them to trace the harms directly back to the hospital lab.