Stanford Hospital, associates to pay $4.1M to resolve data breach lawsuit

Calif.-based Stanford Hospital & Clinics and two of its vendors, Multi-Specialty Collection Services and Corcino & Associates, are required to pay more than $4.1 million to settle a class action lawsuit involving a health data breach.

According to the claim, the hospital violated state privacy laws by allowing medical information of approximately 20,000 emergency room patients to be posted online for almost a year, according to the San Jose Mercury News.

Patient Shana Springer sued the hospital and associated vendors, for $20 million in September 2011 alleging that her medical information, and that of other patients treated in the hospital’s emergency room between March 1, 2009 and Aug. 31, 2010, was illegally displayed on a public website. Compromised medical information included medical record numbers, hospital account numbers, billing charges and emergency room admission and discharge dates. The psychiatric diagnosis of one patient also was disclosed, according to the story.

The vendors will pay $3.3 million of the $4.125 million settlement, according to a statement released by Stanford. The hospital will pay $500,000 for a program to educate vendors on recent privacy regulations as well as $250,000 to cover the administrative costs of the settlement.

“Patient privacy and data security continues to be an utmost priority at Stanford Hospital & Clinics," the statement said. "We are pleased to have put this case behind us and look forward to helping outside vendors better understand and comply with new patient privacy regulations."