In a significant legal development, a class action lawsuit has been filed against a prominent medical institution for allegedly failing to protect sensitive patient information. The complaint was lodged by Brian Holovaty on September 16, 2024, in the United States District Court for the Northern District of Illinois against Illinois Bone & Joint Institute, LLC (IBJI).
The lawsuit claims that IBJI negligently failed to safeguard the personally identifiable information (PII) and protected health information (PHI) of approximately 182,670 individuals. According to the complaint, IBJI detected unauthorized access to its computer systems on July 4, 2024. The breach reportedly occurred between May 30 and July 4, 2024, during which cybercriminals accessed and stole highly sensitive data including names, addresses, dates of birth, Social Security numbers, diagnosis and treatment information, and health insurance details.
Holovaty's complaint asserts that IBJI was aware or should have been aware of its responsibility to protect such sensitive data under state and federal laws including HIPAA. The plaintiff alleges that IBJI's failure to implement adequate security measures led to the data breach. The lawsuit highlights that despite being legally obligated to protect patient confidentiality as per state and federal law, IBJI failed in its duty by not adopting reasonable security practices such as encryption and employee training.
The plaintiffs are seeking compensatory damages for identity theft risks they now face due to the breach. They also demand punitive damages for what they describe as IBJI’s gross negligence in handling their private information. Additionally, they seek injunctive relief requiring IBJI to improve its data security measures significantly.
Representing the plaintiffs is attorney Brian Holovaty from Des Plaines, IL. The case Case ID is: 1:24-cv-08499.