– Multiple lawsuits have been filed against Harvard Pilgrim Health Care (HPHC) and its parent company Point32Health, accusing them of failing to protect personally identifiable information and protected health information.– Valeria Salerno Gonzales, a member of HPHC, filed a lawsuit alleging damages to the health insurer’s members.– Other lawsuits claim that HPHC violated the HIPAA Security Rule.– One plaintiff reported an increase in spam texts and calls after the breach, as well as anxiety, stress, sleep disruption, and fear.– Point32Health has posted a systems update and is working on bringing their systems back online.– HPHC is not affiliated with Harvard University, and Point32Health was formed through a merger with Tufts Health Plan.
Multiple lawsuits accuse Harvard Pilgrim Health Care and its parent company Point32Health of “willful failure” to uphold their responsibilities to protect personally identifiable information and protected health information.
Attorneys for Valeria Salerno Gonzales, a member of HPHC, filed a four-count, 32-page lawsuit for a jury trial against HPHC and Point32Health in Massachusetts court alleging damages and future damages to the health insurer’s upwards of 2.5 million members, As highlighted by a report Tuesday in The Harvard Crimson.
Salerno Gonzalez v. Harvard Pilgrim Health Care Inc. et al alleges HPHC’s “reckless and grossly negligent” approach to foreseeable risks and known threats.
“As a proximate and foreseeable result of Defendants’ grossly negligent conduct, plaintiff and class members have suffered damages and are at imminent risk of additional harms and damages,” the lawsuit reads.
Additional lawsuits allege HPHC violated the HIPAA Security Rule, the HIPAA Journal reported.
Tracie Wilson v. Harvard Pilgrim Health Care, Inc. and Point32Health, Inc. alleges damages in part based on delay – the time it took the defendants to detect and report the breach.
The plaintiff reported an increase in spam texts and calls after the breach, as well as anxiety, stress, sleep disruption and fear, As highlighted by the story.
On June 8, Point32Health posted a systems update asserting that providers should continue providing care to HPHC members and that services will be covered.
“We have made significant progress in bringing our systems back online and processing various business transactions,” Point32Health spokesperson Kathleen Makela said in a statement to the Harvard University publication.
She reportedly noted that information sharing with partners has resumed and more core functions will be coming back online in the weeks ahead.
“Our primary focus during recovery is to make sure members and our customers receive the care and services they need as quickly and as safely as possible.”
HPHC, founded by a former Harvard Medical School dean, is not part of Harvard University, The Crimson says.
In the year 2000 when the insurer went into receivership with now former Massachusetts’ Governor Charlie Baker appointed as receiver, the state sued the university to keep Harvard in its name. Point32Health was formed when HPHC merged with Tufts Health Plan in 2021.
In May, Point32Health confirmed the health data breach…
Multiple lawsuits have been filed against Harvard Pilgrim Health Care (HPHC) and its parent company Point32Health, accusing them of “willful failure” to protect personally identifiable information and protected health information. One of the lawsuits, filed by Valeria Salerno Gonzales, alleges damages and future damages to the health insurer’s 2.5 million members. The lawsuit claims that HPHC’s approach to foreseeable risks and known threats was “reckless and grossly negligent.” The plaintiffs argue that they have suffered damages and are at risk of further harm as a result of the defendants’ actions.
Other lawsuits allege that HPHC violated the HIPAA Security Rule. Tracie Wilson, another plaintiff, claims damages based on the delay in detecting and reporting the breach. Wilson reported experiencing an increase in spam texts and calls, as well as anxiety, stress, sleep disruption, and fear after the breach.
In response to the lawsuits, Point32Health posted a systems update on June 8, assuring providers that they should continue providing care to HPHC members and that services will be covered. The company spokesperson, Kathleen Makela, stated that significant progress has been made in bringing the systems back online and processing business transactions. Makela also mentioned that information sharing with partners has resumed and more core functions will be restored in the coming weeks. The primary focus during the recovery process is to ensure that members and customers receive the necessary care and services as quickly and safely as possible.
It is important to note that HPHC, although founded by a former Harvard Medical School dean, is not part of Harvard University. In the year 2000, when the insurer went into receivership, the state sued the university to keep Harvard in its name. Point32Health was formed through the merger of HPHC and Tufts Health Plan in 2021.
This recent data breach and the resulting lawsuits highlight the larger trend of healthcare organizations facing legal consequences for failing to protect sensitive information. In May, Point32Health confirmed the health data breach, further emphasizing the need for robust security measures and compliance with regulations such as the HIPAA Security Rule.
As the lawsuits progress, it remains to be seen how HPHC and Point32Health will address the allegations and mitigate the damages suffered by their members. The outcome of these cases could have significant implications for the healthcare industry and the protection of patient data.
