Revenue Cycle Firm Settles GitHub PHI Breach Lawsuit for $7M

Revenue cycle management firm MedData has agreed to a $7 million settlement in a class action lawsuit filed after an employee inadvertently uploaded and exposed the health and personal information of about 136,000 individuals on the public-facing part of GitHub for more than a year.

See Also: Panel Discussion | Accelerate HITRUST certification for faster time-to-market and improved ROI

Under the court-approved preliminary settlement, MedData, which is now part of Spring, Texas-based Elevate Patient Financial Solutions, will offer class members a choice of two payment tiers and will also enhance its cybersecurity practices.

The first payment tier covers documentable out-of-pocket expenses related to the incident, up to $5,000. The second tier provides a payment of up to $500 for “de minimis” – or minimal -affirmative action in response to being notified about incident.

All class members are eligible to receive 36 months of complimentary health data/fraud monitoring services and $1 million in fraud and medical identity theft insurance coverage.

Also, MedData is required to implement and maintain for two years an enhanced cybersecurity program that includes:

• Annual cybersecurity testing and training on data privacy;
• Robust monitoring and auditing for data security issues, including firewalls and up-to-date antimalware programs;
• Data encryption and access controls;
• Annual penetration testing;
• A data deletion policy;
• A monitored internal whistleblowing mechanism.

The company’s board of directors is also required to annually consider “appropriate” cybersecurity spending and regular updates to internal security policies and procedures. The settlement does not specify an amount for cybersecurity spending.

While the settlement appears to be “hard-fought” by the plaintiffs and class members’ counsel, “it must be kept in mind that these incidents involve non-ephemeral sensitive information rather than payment card data, etc.,” said cybersecurity attorney Steven Teppler of the law firm Mandelbaum Barrett PC, who is not involved in the MedData case. “Victims may be working to fix identity compromise events for years to come.”

Also, a more in-depth investigation into the incident might have raised additional concerns about the use of potentially insecure third-party software by MedData, he said.

The settlement agreement does not mention anything about MedData being required to implement secure software development policies and enforcement as part of the company’s enhanced cybersecurity program, according to Teppler.

Still, the kind of inadvertent uploading of patient data by an employee in the MedData breach offers other entities important lessons, he said.

“This focuses on internal code development efforts. Insufficient risk assessment efforts, policy development and enforcement governing development – meaning coding, and in particular internal coding efforts that also incorporate third-party or open-source software – opens the door to increased risk and liability.”

The settlement of the M.S. v. Med-Data Inc. case is the last of five proposed federal class actions that were filed against the company in the aftermath of the breach. The other four cases were previously dismissed.

The amended lawsuit complaint at the center of the settlement states that the unencrypted MedData data was discovered on the open-source software development hosting website GitHub in December 2020 by Dutch independent security researcher Jelle Ursem (see: Vendor Breach Involved PHI Exposure on GitHub).

Under the terms of the settlement, MedData is required to ask Ursem to return all Med-Data PHI in his possession and to request written assurance from GitHub that MedData’s data was wiped or “locked up” and is inaccessible to anyone.

Elevate declined Information Security Media Group’s request for comment on the MedData settlement. But an Elevate spokeswoman said MedData and Elevate are affiliated companies with common ownership.

At the time the incident occurred, MedData was under different ownership and Elevate did not exist, she said. “The employee responsible for the data incident voluntarily quit working for MedData in September 2019 prior to MedData’s acquisition by its current owners.”

Breach Details

The breach, which Med-Data reported to federal regulators in April 2021 as affecting 135,908 individuals, compromised patient names, addresses, birthdates, Social Security numbers, diagnoses, conditions, claim information, dates of service, subscriber IDs, medical procedure codes, provider names and health insurance policy numbers.

The GitHub exposure also affected several of MedData’s healthcare clients, including Houston, Texas-based Memorial Hermann; Wausau, Wisconsin-based Aspirus Health Plan; Peoria, Illinois-based OSF HealthCare; and the University of Chicago Medical Center.

MetaData’s investigation determined that at least one of its employees had saved files containing patients’ protected health information and personal identifiable information to the public-facing GitHub platform between December 2018 and September 2019, the lawsuit alleges. The files were removed from the website on Dec. 17, 2020, which means the data was exposed for at least 13 months, it alleges.

The preliminary settlement was approved by a Texas federal court last month, and a fairness hearing is scheduled for Sept. 11.

Other Exposures

Accidental exposures of data on GitHub have been at the center of other breaches in the healthcare sector, as well as in other industries.

In October 2022, car manufacturer Toyota said a subcontractor accidently uploaded onto a public GitHub repository source code for T-Connect containing an access key to a data server holding nearly 300,000 email addresses (see: Toyota Exposed Auto Location Data of 2M Japanese Customers).

In 2020, Ursem, along with privacy advocate “Dissent” of the DataBreaches.net blog, published a report that describes how nine U.S. organizations exposed, on GitHub, PHI that affected at least 150,000 patients (see: Medical Records Exposed Via GitHub Leaks).