In a significant legal development, a class action lawsuit has been filed against a major healthcare provider for allegedly failing to protect sensitive patient information. The complaint, filed by Kathryn Richards in the Superior Court of California, County of San Francisco on April 4, 2025, accuses Dignity Health of negligence following a data breach that compromised the private health information of thousands of patients.
The lawsuit centers around a data breach that occurred between September 17 and September 20, 2024, during which unauthorized cybercriminals accessed Dignity Health's systems and stole sensitive personal and medical information. This breach affected over 65,000 individuals who had entrusted their private health details to Dignity Health’s facilities in Northern California. Richards claims that the healthcare provider failed to implement adequate security measures to safeguard this information and delayed notifying affected individuals by several months. "Dignity Health unreasonably delayed for 157 days after first discovering the Data Breach," states the complaint, emphasizing the inadequate response and lack of timely communication from the defendant.
Richards argues that Dignity Health's actions violated multiple laws, including the Federal Trade Commission Act (FTCA) and the Health Insurance Portability and Accountability Act (HIPAA). The plaintiff alleges that these violations stemmed from insufficient data protection protocols and an unreasonable delay in informing patients about the breach. Furthermore, Richards highlights that Dignity Health's offer of limited call center support through Kroll is insufficient to address the potential long-term consequences faced by victims of identity theft.
The plaintiffs are seeking various forms of relief from the court. They demand compensatory damages for losses incurred due to identity theft risks and seek injunctive relief requiring Dignity Health to enhance its data security systems significantly. Additionally, they request lifetime credit monitoring services for all affected individuals as part of their compensation package.
Representing Richards and the proposed class are attorneys M. Anderson Berry, Gregory Haroutunian, Brandon P. Jack from Clayeo C. Arnold Professional Corporation based in Sacramento, California; alongside Daniel O. Herrera and Nickolas J. Hagman from Cafferty Clobes Meriwether & Sprengel LLP in Chicago, Illinois. The case is identified under Case No. CGC-25-624031.