The Georgia Supreme Court has ruled that patients may proceed with a lawsuit against a Clarke County medical center. Patients were upset to learn that, in 2016, the clinic’s computer databases were hacked and they filed a lawsuit, which was initially dismissed by an Athens-Clarke County trial court.
According to their complaint, the plaintiffs alleged that in June 2016, an anonymous hacker identified only as the “Dark Overlord” stole the personal data of at least 200,000 current and former patients of Athens Orthopedic Clinic, including Social Security numbers, addresses, birth dates, and health insurance details. After discovering the hack, the clinic refused to pay the ransom demanded by the hacker to unlock its databases. At least some of the stolen identity information was offered for sale on the so-called “dark web,” and some of the information was made available, at least temporarily, on Pastebin, a data-storage website.
According to the Gwinnett Daily Post, the plaintiffs sought a declaratory judgment from the court requiring the clinic to take certain actions to ensure the future security of class members’ identity information. They also sought reimbursement for their legal costs, and they sought reimbursement for costs incurred and future costs that would be incurred for the purchase of credit monitoring and identity theft protection. Each plaintiff alleged that she had “spent time calling a credit reporting agency and placing a fraud or credit alert on her credit report to try to contain the impact of the data breach and anticipates having to spend more time and money in the future on similar activities.”
One victim alleged that she had received fraudulent charges on a credit card shortly after the data breach and had to spend time getting the charges reversed by the credit card company. And their complaint alleged that, “Even class members who have not yet experienced identity theft or are not yet aware of it nevertheless face the imminent and substantial risk of future injury.”
The clinic filed a motion asking the court to dismiss the lawsuit, and on June 26, 2017, the trial court granted the motion in a two-sentence order. After several appeals, the Supreme Court agreed a trial was feasible.
“We conclude that the injury the plaintiffs allege that they have suffered is legally cognizable,” the Supreme Court opinion says. “Because the Court of Appeals held otherwise in affirming dismissal of the plaintiffs’ negligence claims, we reverse that holding. Because that error may have affected the Court of Appeals’ other holdings, we vacate those other holdings and remand the case.”
This is one of the first large-data breach cases to reach the Georgia Supreme Court.
