A lawsuit filed against Charleston Area Medical Center, after the hospital inadvertently shared the personal and contact information of more than 3,000 patients on the Internet, can proceed as a class-action suit, the state Supreme Court ruled in a decision announced Wednesday.
The lawsuit, brought forward by five patients whose information was leaked, was denied class-action status by Kanawha Circuit Judge James Stucky in June 2013. The circuit court found the petitioners didn’t have the standing to bring a class-action lawsuit. Wednesday’s ruling overturned Stucky’s decision, and sent the case back to Kanawha Circuit Court.
In February 2011, thousands of CAMC patients received a letter from the hospital system notifying them that their medical and personal information, kept in a hospital database, had accidentally been uploaded online. The database contained the names, contact details, Social Security numbers and birth dates of patients.
Neither the petitioners nor any of the estimated 3,655 patients affected by the privacy breach had reported attempted identity theft or subsequent breaches of privacy resulting from the leak. Because they were unable to show they had suffered a "concrete or particularized injury," Stucky ruled, they didn’t have standing to sue.
The petitioners argued that their injury was in the potential risk for future identity theft. The Supreme Court sided with Stucky in that the risk of future identity theft does not constitute injury, but ruled that doctor-patient confidentiality had been violated by the leak. Justices found that the CAMC patients had a legal right for their medical information to be kept confidential.
The Supreme Court also found that the circuit court had erred in its determination that the petitioners did not share enough commonality, typicality and predominance of common issues of law or fact to be certified as a class-action suit.
In the unsigned ruling, justices emphasized that they were not considering the merits of the CAMC patients’ case against the hospital, only whether they should be allowed to continue with their lawsuit.
Justice Menis Ketchum dissented, calling the case "a typical example of a frivolous class-action lawsuit." Noting that none of the petitioners' records had been accessed by an unauthorized person, Ketchum said that, as the information was removed shortly after CAMC discovered the error, there was no real injury to the petitioners.
"No harm, no foul. The plaintiffs lack standing to sue or to represent a class of unnamed plaintiffs," Ketchum wrote.
He added that should discovery reveal that no unnamed member of the class has suffered harm, the trial judge should decertify the class action and dismiss the suit. "Of course, this cannot occur until massive amounts of attorney fees are incurred by the defendants conducting discovery of more than 3,000 unnamed class members," he wrote.
Reach Lydia Nuzum at email@example.com or 304-348-5169.