Northwell faces more than a score of lawsuits after data breach

Patients have filed more than 20 lawsuits against Northwell Health after their personal data and health information was allegedly leaked in a data breach at a medical transcription firm used by Northwell.

Northwell was named in more than 20 federal and state lawsuits, including many that seek class-action status, according to a Dec. 6 letter from the organization's lawyer, which requested more time to respond to a suit in the U.S. District Court in the Eastern District of New York. 

"Northwell requests additional time to evaluate the merits of each claim, understand the complexities of discovery, speak with plaintiff and co-defendant counsel in each case, and consider options for consolidation or transfer ," attorney Christopher Conniff wrote. 

Federal and state laws, along with industry standards, obligate Northwell to ensure any vendors it works with have sufficient security practices, legal complaints say.

The New Hyde Park-based provider fell short, and an unauthorized party accessed the data of nearly 4 million patients while infiltrating Perry Johnson & Associates, a medical transcription service, this spring, the lawsuits allege. While each plaintiff's chances vary based on the facts involved, lawyers have previously struggled in similar cases to prove their clients were harmed by a specific data breach, given how widespread they are, said one attorney not involved in the lawsuits.

Since learning of the breach last month, Northwell patients have spent time and money monitoring their finances, credit and health care bills for errors, the cases claim. They've also been anxious about being the target of identity theft, fraud or extortion, the complaints say.

One plaintiff, a Coram resident, was "notified by credit monitoring services that his information was detected on the 'dark web,'" a private part of the internet where criminals can purchase data and use it to extort people or commit identity fraud, one complaint alleged. That man has also begun receiving mail addressed to others at his home address, the filing said.

Northwell has said its systems weren't impacted by the cyberattack. The organization is offering victims a year of identity theft protection services, according to one complaint.

"Because these matters are in active litigation, we will refrain from commenting regarding the cases," Northwell spokeswoman Barbara Osborn said.

Perry Johnson & Associates didn't respond to requests for comment. 

Plaintiffs often struggle to prove their situations are due to a particular data breach, said Linn Freedman, chair of the Data Privacy and Cybersecurity Team at Robinson+Cole, a national law firm.

"It's very hard for plaintiffs to be able to say this credit card was opened because of this data breach, when in many instances, peoples' data has not just been compromised in one data breach," Freedman said. 

But courts are not requiring "exact causal connection" because they know tying a fraudulent bank charge, for instance, to one breach can be difficult, according to Stuart Davidson, an attorney at Robbins Geller Rudman & Dowd LLP, who is representing a Seaford resident in a case filed in state court.

By Sarina Trangle

sarina.trangle@newsday.com@SarinaTrangle

Sarina Trangle covers affordability and cost of living issues and other business topics. She previously worked as an editor and reporter at amNewYork.