AMM Faces Class Action Lawsuit Over Data Breach, Plaintiffs Seek Damages

August 2, 2024 Update: American Medical Management has settled the lawsuit for $2,500,000.

‍

In a recent development, a class action complaint has been filed against Advanced Medical Management, LLC (AMM), a healthcare provider. The plaintiff, Tyler Woerner, and other class members allege that AMM failed to secure and safeguard their sensitive personal identifiable information (PII) and protected health information (PHI).

According to the lawsuit, the data breach occurred in May 2023 and compromised the PII and PHI of approximately 319,485 individuals. The compromised information included names, addresses, email addresses, phone numbers, Social Security numbers, driver's licenses, treatment or diagnosis information, and more.

Interestingly, the defendant's alleged failure to promptly notify affected individuals about the data breach is a significant part of the complaint. It wasn't until June 29, 2023, that AMM sent out notices about the breach, which, according to the plaintiffs, was not timely enough.

"Defendant's failure to implement adequate cybersecurity measures and protect the collected information led to the breach," the lawsuit states. This alleged negligence has put the plaintiffs and class members at an ongoing risk of fraud and identity theft.

The stolen PII and PHI, the plaintiffs argue, can be sold on the dark web, making it valuable to criminals. The risk of identity theft is imminent, and victims may suffer financial losses, loss of time, invasion of privacy, and other damages.

"The loss of time and financial costs incurred are directly tied to guarding against the imminent risk of identity theft," the lawsuit reads. This highlights the gravity of the situation and the potential consequences for the affected individuals.

The plaintiffs also accuse AMM of breach of fiduciary duty. They argue that the healthcare provider had a duty to protect their private information, a duty which they allegedly breached by failing to implement adequate security measures and safeguards.

"The defendant was unjustly enriched by accepting payment for services without providing adequate data security," the lawsuit alleges. This claim suggests that AMM profited at the expense of its patients' privacy and security.

The plaintiffs are seeking a declaratory judgment to establish the defendant's legal duties and an injunction to require improved data security measures. They are also requesting compensatory, punitive, and nominal damages, as well as restitution and disgorgement of profits.

The lawsuit is a stark reminder of the importance of data security in the healthcare sector. The Federal Trade Commission (FTC) recognizes the importance of reasonable data security practices and considers the failure to protect confidential consumer data an unfair act or practice.

While the allegations against AMM are yet to be proven in court, this case serves as a wake-up call for healthcare providers to prioritize data security and protect their patients' private information.