When patients visit a doctor, undergo medical testing, or receive treatment at a hospital, they expect their personal health information to remain private. Recent cybersecurity incidents involving healthcare companies have raised new concerns about how securely that information is stored and who is responsible when it falls into the wrong hands.
In North Texas, Mansfield-based AngMar Management Services, which provides support services to home health and hospice providers, reported a data breach affecting 126,196 people. A separate Texas filing identified 35,916 affected Texans. The company discovered suspicious activity in July and later determined that unauthorized individuals had accessed information that could include Social Security numbers, medical histories, diagnoses, prescription details, and health insurance records.
The Mansfield incident is far from the only healthcare data breach affecting Texans this year.
In February, the Texas Attorney General announced an investigation into Conduent and Blue Cross Blue Shield of Texas after a breach exposed sensitive information of about four million Texans. State officials are examining the companies' security practices and compliance with Texas law.
More recently, laboratory testing company Quest Diagnostics disclosed unauthorized access to a system healthcare providers use to order tests and retrieve results. The company believes some patient records may have been accessed, although the number of affected patients and the types of information involved remain unknown. Quest has temporarily suspended access to the affected system while it investigates.
Together, these incidents highlight a growing concern for patients that medical information can be exposed not only through hospitals and doctors' offices, but also through insurers, laboratories, and companies that manage healthcare records behind the scenes.
Why Medical Data Breaches Can Be Especially Harmful
A stolen credit card can usually be canceled and replaced. Medical information is much harder to protect once exposed.
Healthcare records often contain identifying information and sensitive health details, including diagnoses, prescriptions, treatments, and insurance coverage. Criminals may use stolen information to obtain medical services, submit fraudulent insurance claims, or impersonate patients. In some cases, medical identity theft can also result in incorrect information being added to a person's health records, potentially creating problems with future treatment or insurance coverage.
Even when stolen information isn't immediately misused, patients may face years of uncertainty about where their records went and how they might be used.
Federal and Texas Laws Protecting Medical Privacy
Healthcare providers and other organizations that handle medical information must comply with federal and state privacy requirements. The federal Health Insurance Portability and Accountability Act (HIPAA) sets standards to protect certain medical information and requires covered healthcare organizations and their business associates to implement appropriate safeguards.
Texas also protects patient information under the Texas Medical Records Privacy Act (TMRPA), which extends certain privacy requirements beyond traditional healthcare providers to organizations such as schools, technology companies, and other businesses that handle protected health information. According to the Texas Attorney General's patient privacy guidance, patients have rights concerning how their health information is used, disclosed, and protected.
Federal and Texas laws require organizations to notify affected individuals of certain data breaches without unreasonable delay, generally within 60 days. Under HIPAA, the deadline begins when a breach is discovered, while Texas law measures it from when a business determines a breach occurred.
What to Do After a Medical Data Breach
Receiving a medical data breach notification can be unsettling, especially when it involves information that can't be easily changed, such as a Social Security number or medical history.
If you receive a notification, start by reviewing what information may have been compromised and whether the organization is offering identity theft protection or credit monitoring services. Also review medical bills, insurance statements, and explanations of benefits for unfamiliar charges or services. If your Social Security number was exposed, consider placing a fraud alert or security freeze on your credit reports.
Keep copies of breach notifications, correspondence, and any evidence of suspicious activity. If you discover inaccurate information in your medical records, contact your healthcare provider and insurer to request corrections.
Patients who believe their medical privacy rights have been violated can also file complaints with the U.S. Department of Health and Human Services Office for Civil Rights or the Texas Attorney General's Office.
Can You Sue After a Medical Data Breach in Texas?
A medical data breach can do more than expose private information. When patients suffer financial losses or other harm because their information wasn't adequately protected, they may have grounds to pursue compensation through a civil lawsuit.
Although HIPAA requires covered healthcare organizations to protect patient information, it doesn't allow individuals to sue directly for damages under the federal law. Instead, individuals may bring lawsuits under Texas law based on negligence, breach of contract, or other applicable legal claims.
In a negligence case, the focus is on whether the organization had a legal duty to protect the information, failed to meet that duty, and caused harm as a result. Evidence of inadequate cybersecurity measures, ignored security warnings, or delayed responses to known vulnerabilities may help establish what went wrong.
The consequences for patients matter as much as the security failure itself. Medical identity theft can lead to fraudulent insurance claims, unexpected medical bills, damaged credit, and expenses associated with correcting compromised records. Patients should document these losses, along with any unauthorized use of their information, because that evidence may be important in establishing a claim.
Large healthcare breaches can also lead to class-action lawsuits, allowing patients with similar claims to pursue legal action together. These lawsuits may allege that a company failed to adequately protect thousands of people's information. A court must determine whether the case qualifies as a class action, and being affected by a breach doesn't automatically entitle someone to compensation.
An attorney can review the breach notification, the information exposed, evidence of misuse, and any resulting losses to help determine whether an individual claim or an existing class action may be appropriate.
The Growing Responsibility to Protect Patient Information
Electronic medical records, online patient portals, and digital laboratory systems have made healthcare information easier to access and share. They've also created more opportunities for sensitive information to be compromised.
Patients shouldn't have to worry that getting medical care could put their personal information at risk. Hospitals, insurers, laboratories, and the companies they work with all have responsibilities to protect the sensitive information entrusted to them. When those protections fail, understanding what happened and the harm it caused is key to determining accountability.
If your medical information has been exposed and you've suffered financial losses or other harm, you may have legal options. Contact The Cochran Firm Texas at 1-800-843-3476 to discuss your circumstances.
