Lurie Children’s sued over patient information breach

A mother is suing Lurie Children’s Hospital and two former employees who allegedly accessed the medical records of her 3-year-old daughter, who underwent a sexual abuse examination at the hospital early last year.

The mother received a letter from the hospital in late December informing her a nursing assistant had been accessing her daughter’s medical records “without a work-related reason,” according to the lawsuit.

The lawsuit was filed Friday in Cook County Circuit Court. The lawsuit does not name the mother, the daughter or the former hospital employees.

The mother hired an attorney to better understand the breach and ensure her daughter’s records were protected in the future.

“Rather than take it seriously, Lurie chalked it up to the curiosity of a bored employee,” according to the suit. “Lurie refused to discuss whether this was a more widespread problem.”

The hospital later reported to the U.S. Department of Health and Human Services the records of 4,195 children were accessed in the 12 months ending in September 2019, the lawsuit said.

On May 4, the hospital disclosed in another letter to the mother that a different employee had also accessed her daughter’s medical records without authorization, the lawsuit said. That breach affected 4,824 patients between November 2018 and February 2020, according to the suit.

In a statement Friday, Lurie said: “In December 2019 and May 2020, Lurie Children’s notified some of our patients about two nurse assistants who had accessed certain patients’ medical records without an identified patient need. We have no reason to suspect any misuse of patient information associated with this incident.

“Lurie Children’s addressed this issue in accordance with our disciplinary policies, and the employees no longer work for the hospital. We remain committed to providing the highest standard of patient care, as well as protecting the privacy and confidentiality of our patients.”

A separate notice posted to the hospital’s website told patients a call center had been established to answer breach-related questions.

In her lawsuit, the mother said she worries about identity theft and the medical records ending up for sale on the dark web.

The lawsuit seeks class-action status to include multiple patients whose records were improperly accessed.

The suit asks for damages and restrictions be put in place to prevent further breaches. The suit also seeks ongoing credit monitoring for those affected.