Expert answers questions about CHS class-action lawsuit

Aug. 30--WILKES-BARRE -- A security breach in Community Health System's databases has resulted in 4.5 million patients being affected and a class-action lawsuit by five patients in Alabama that were affected.

Based in Franklin, Tennessee, CHS owns or leases 206 hospitals in 29 states, including: Wilkes-Barre General Hospital; First Hospital in Kingston; Regional Hospital and Moses Taylor Hospital, both in Scranton; and Berwick Hospital and Tyler Memorial Hospital in Tunkhannock.

But what is a class-action lawsuit?

Ruth Hughes, a visiting assistant professor for the Sidhu School of Business and Leadership at Wilkes University, provided her insight.

Q. What exactly is a class-action lawsuit?

A. A class-action lawsuit is one in which there are a large number of plaintiffs who have common actions against a defendant. It does need to be certified by a court and must meet certain standards. For example, there must be sufficiently large numbers of plaintiffs or potential plaintiffs to be a class action.

The concept is that separate actions by each plaintiff would be too unwieldy for the court system.

Another requirement is that there must be common facts in each case so that they can be tried all together. A class action is brought by representative plaintiffs on behalf of all those that were wronged in a common set of circumstances. The case of the representative plaintiffs (injuries suffered, etc) must be typical of the rest of the class (the rest of the potential plaintiffs).

Q. When are class-action lawsuits typically filed?

A. They are often brought with consumer product actions, securities fraud, environmental cases and the like. They are filed when there are a large number of people impacted by a common circumstance, such as a defective product.

Q. How is such a lawsuit different from other lawsuits?

A. Normally, the plaintiffs are all named in the complaint that is filed and involve one set of facts -- one incident. With a class action, only the representative plaintiffs are named and initially not all of the plaintiffs are even known.

Q. What are some pros and cons of class-action lawsuits?

A. From the point of view of a plaintiff, one pro is that a class action may allow a suit that would be have been too expensive or difficult to bring individually. Similarly an attorney that might view one plaintiff's suit as too small might be induced to take a class action with the potential cumulative awards.

A con is that class action suits are complicated and difficult to bring -- they do require attorneys experienced and knowledgeable in that area of the law.

What does the lawsuit say?

According to a report the company filed on Aug. 18 with the U.S. Securities and Exchange Commission, the attack took place in April and June.

CHS and its forensic expert, Mandiant, believe that the attacker was an "advanced persistent threat" originating from China. The group allegedly used highly sophisticated malware and technology to attack the company's computer systems, and was able to bypass security measures to copy and transfer certain data from the company.

The transferred information did not include any medical information or credit card information, but it did include names, addresses, birth dates, telephone numbers and Social Security numbers, CHS said.

The lawsuit, filed on Aug. 20, alleges information transferred is considered protected under the Health Insurance Portability and Accountability Act (HIPAA).

The lawsuit also alleges that CHS "did not provide adequate security measures to protect Plaintiffs' sensitive information," and that CHS failed to notify patients of the breach in a timely manner, and "therefore, Plaintiffs were unable to take action to protect themselves from harm."

While no one from Pennsylvania has joined the lawsuit, attorney David Stewart was confident that more would join the lawsuit. Stewart, an attorney with Stewart & Stewart, PC, in Anniston, Alabama, represents the clients in the class-action lawsuit.

"I certainly hope so," he said. "We welcome anybody that wants to join. We feel like they have a legitimate claim, whether or not their identity has been stolen."

No lawsuits against CHS referencing the data breach have been filed in the U.S. District Court for the Middle District of Pennsylvania or the Luzerne County Court of Common Pleas.

Stewart said some that have approached his offices already have had their identity stolen as a result of the security breach.

___

(c)2014 The Times Leader (Wilkes-Barre, Pa.)

Visit The Times Leader (Wilkes-Barre, Pa.) at www.timesleader.com

Distributed by MCT Information Services