Community Health Center Inc. faces lawsuits over data breach
HBJ PHOTO | DAVID KRECHEVSKY
Community Health Center Inc.'s office at 675 Main St. in Middletown.
Middletown-based Community Health Center Inc. (CHC) is the target of more than a half dozen separate federal lawsuits following a data breach that affected the personal information of more than 1 million patients and employees.
The individual lawsuits were filed in U.S. District Court for the District of Connecticut between Feb. 5 and 13, and each seeks class action status.
CHC is a federally qualified health center that provides primary care via 17 centers across Connecticut. On Jan. 30, it announced that on Jan. 2 it had “suffered a criminal attack on its systems containing health information about patients.”
CHC said it sent letters about the breach to all current and former patients, as well as to everyone who received a COVID test or vaccine at a CHC clinic but were not otherwise patients of CHC.
According to the U.S. Department of Health and Human Services Office for Civil Rights Data Breach portal, a total of 1,060,936 individuals were affected. That total includes pediatric patients and their parents and guardians.
CHC stated that for patients, the data that may have been “accessed or taken” included information in health records, which could include a patient’s name, Social Security Number (SSN), date of birth, address, phone number, email, diagnoses, treatment details, test results and health insurance information.
For those who received only a test or vaccine at a CHC clinic, the personal information that may have been compromised is more limited, including an individual’s name, date of birth, phone number, email, address, gender, race, ethnicity and insurance information, if it was provided. CHC added that in “very limited circumstances” it also collected an SSN from vaccine patients, so it also could have been compromised.
In the wake of the breach, CHC said, it has strengthened its digital security measures. It also is offering all patients and others who had provided an SSN with free identity theft protection through IDX, an Oregon-based company that provides those services.
One of the lawsuits, filed on behalf of Connecticut resident Brian McCarthy, includes a claim that while CHC told those affected that the breach occurred on Jan. 2 and that it had “stopped the criminal hacker’s access within hours,” the breach “actually began months earlier,” in October.
That claim is based on information provided by the Maine Attorney General’s Office, which issued a notice that states the breach first occurred on Oct. 14, 2024.
“Because it is confirmed that Private Information was exfiltrated and
acquired by cybercriminals during the Data Breach, there is no question Plaintiff’s and Class Members’ Private Information is in the hands of cybercriminals who will continue to use the stolen Private Information for nefarious purposes for the rest of their lives,” McCarthy’s lawsuit states.
The seven federal lawsuits filed in February seek compensatory, punitive and nominal damages, restitution, injunctive and declaratory relief, reasonable attorneys’ fees and costs and other remedies determined by the court.
CHC did not respond to requests for comment.
Most Recent
Most Recent
0 Comments