Hospitals, Epic sued after clinician allegedly accesses nude photos of 400+ patients

The University of Kansas Health System (KU Health) is named as a defendant in a lawsuit after a physical therapist under its employ allegedly “unlawfully accessed” sensitive patient data, including nude photographs used for clinical purposes.

In a lawsuit filed Tuesday in a U.S. District Court, attorneys representing two women said more than 400 patients fell victim to the physical therapist's actions, which the health system acknowledged in a data breach notification sent to the “Jane Doe” plaintiffs bringing the case.

The notifications were sent out in 2023, according to reporting from local Fox 4, citing court documents.

In the lawsuit, Lawrence Memorial Hospital is named as a defendant alongside KU Health. Epic Systems, the EHR provider, has also been named in the filing.

According to lawyers representing the plaintiffs, the incidents began in February 2021 but were not discovered until two years later. The unnamed physical therapist allegedly used his provider credentials to access records from Epic’s portal, taking documents including nude photos of at least 425 patients, most of whom were seeking plastic surgery.

The therapist in question had no involvement in the care of any of the patients, the lawsuit claims.

Notably, lawyers argue the therapist accessed records from Lawrence Memorial through the shared EHR portal, despite being employed solely by KU Health.

When approached by Fox 4, KU Health said it was reviewing the claims:

“The University of Kansas Hospital is one of three parties named in a lawsuit alleging violations of patient privacy. We take this seriously; patient privacy is very important to us. We just received the complaint, and our teams are reviewing it currently,” a spokesperson said.

Lawrence Memorial Hospital released its own statement to the media, claiming it had only just been made aware it was named in the lawsuit.

“While we can’t comment on ongoing legal action, we want to reassure our patients and community that we take any suspected violation of patient privacy extremely seriously. This claim is under review by legal counsel, and we will keep the community apprised of any additional facts we can share as they become available,” a spokesperson for the hospital said.

Fox 4 reported that Epic has yet to respond to its request for comment.

This is a developing story. You can read more at the link below.