In the wake of a former employee illicitly accessing more than 1,600 patient records, which included nude photos, Mayo Clinic is facing at least two class action lawsuits and possibly individual civil suits.
Mayo Clinic’s Privacy Office notified 1,614 patients that an employee had inappropriately accessed their records without any medical reason, a violation of the Health Insurance Portability and Accountability Act.
The information included “name, demographic information, date of birth, medical record number, and clinical notes. In addition, we confirmed that images … were accessed.” No credit card information or Social Security numbers were accessed.
In court filings, the person who accessed the records is identified as Dr. Ahman Al Sughayer. The breach was confirmed on Aug. 5 as Al Sughayer was ending his employment with Mayo Clinic.
Two class action lawsuits for the violation of patients’ privacy and the right to seek “compensatory damages in excess of $50,000” have been filed in Olmsted County Court against Mayo Clinic and Al Sughayer on behalf of patients.
A lawsuit led by Minneapolis attorney Marshall Tanick was filed on Friday on behalf of Olga Ryabchuk of Olmsted County. She is one of 1,131 Minnesota patients who had their records accessed. Ryabchuk declined to comment on the case.
“I’m seeing a substantial increase in the number of cases involving improper access to health records at medical facilities around the state,” Tanick said on Friday. “It may be due to the greater accessibility of these records in digital form… as well as due to an increase in voyeurism.”
While the Mayo Clinic statements on the breach did not give a reason for Al Sughayer’s actions, Tanick said he is working under the premise that Al Sughayer accessed the records to see intimate photos of patients undergoing treatments for things like skin conditions and breast cancer.
There are many unanswered questions in this case about Al Sughayer’s actions and his time at Mayo Clinic.
“Litigation has been commenced regarding this matter. Mayo does not comment on pending litigation and, as a result, we respectfully refer you to our prior media notice and the public court file,” Mayo Clinic spokesperson Heather Carlson Kehren wrote on Friday.
Another class action suit was filed by attorneys Joshua Williams and A.L. Brown on Oct. 22 on behalf of Amanda Bloxton-Kippola of Michigan and Chelsea Turner of Minnesota. A trial is tentatively set for Feb. 1.
While the Twin Cities’ law firm of Meshbesher & Spence has not filed any suits connected to this breach, it is looking into the situation.
Andrew Davick of the firm’s Rochester office said an estimated 30 to 50 victims who received letters have contacted Meshbesher & Spence.
“We are looking at these cases. We’re trying to gather more facts to better understand what transpired. We’re very concerned about the nature of the breach,” he said. “The access was of a very personal nature.”
Davick said individual civil claims might be more appropriate in this situation instead of a class action suit.
“Each individual breach is going to be unique to that person,” he said.