SANTA ROSA -- A class-action lawsuit has been filed against St. Joseph Health System, which operates Santa Rosa Memorial, Petaluma Valley and Queen of the Valley hospitals, for allowing private patient data to be searchable online for 31,800 patients across the system's California hospitals, including about 10,000 patients locally.
The suit, filed last week in Sonoma County Superior Court by two allegedly affected patients, is seeking $1,000 per patient, which would total $31.8 million for all the California patients involved, according to the complaint. The suit claims the Orange-based health system was "negligent" and that it "unlawfully failed to maintain and preserve the confidentiality" of patients.
The lawsuit is one of five filed against the health system on the accidental release of information, according to a spokesman for St. Joseph Health.
St. Joseph Health first reported the potential data breach in early February, sending notices to 6,235 patients of Santa Rosa Memorial and another 4,263 patients from Queen of the Valley. Two patients from Petaluma also were notified.
The remainder of affected patients were in Southern California hospitals operated by the health system: Mission Hospital and St. Jude Medical Center, both in Orange County.
At the time of the breach, the health system said the information that was searchable did not include full medical records and that Social Security numbers, patient addresses and financial data were not disclosed.
What was visible by search included patient data such as patient name, body mass index, smoking status, blood pressure, lab results, diagnoses, allergies, demographic info including spoken language, ethnicity, race, gender, birth date and advance directive, which tells health care providers patient wishes for treatment and decision-making.
The suit was filed by Deanna DeBaeke and Loba Moon, who say they were both patients in Sonoma County. According to the suit, Ms. DeBaeke was a patient at Santa Rosa Memorial in April 2011. Earlier this year, she ran a search of her name on Google from her cell phone. Among the results she claims she found were three reports from the health system related to her treatment, including her patient account number and admission or readmission dates, among other information.
Ms. Moon said she was a patient at Memorial in 2011. She received notification from the health system and found that her information was searchable online for as long as seven months, according the the court complaint.
In a statement, St. Joseph said it could not comment on the specifics of pending litigation.