To Avoid Bankruptcy, EMR Firm Settles Lawsuit for $4M

An electronic health record and practice management software firm said the only way to avoid bankruptcy from the consolidation of nine proposed class action lawsuits filed in the wake of a 2022 data breach is to settle the case for $4 million.

See Also: Live Webinar | Securing the Cloud: Mitigating Vulnerabilities for Government

The data breach affected 3 million people – mostly children – who were patients of pediatricians. According to a preliminary settlement document, Connexin Software, which operates as Office Practicum, told the judge it would have to “seek bankruptcy protection had the case proceeded substantially further, much less to judgment.”

Under the preliminary settlement filed in a Pennsylvania federal court on Wednesday, Connexin Software agreed to spend up to $1.5 million on business changes to improve its data security practices.

The court also dealt the plaintiffs’ case a blow with a previous order that dismissed several of the consolidated case’s claims.

“The parties were well-aware of each other’s strengths and weaknesses by virtue of the court’s ruling on Connexin’s partial motion to dismiss, their exchange of thousands of pages of documents, nearly a dozen depositions, and mediation-related discovery and analysis directed at Connexin’s finances,” the settlement document says.

“Rather than prolonging the litigation, plaintiffs have reached a settlement that will immediately provide them and class members with significant benefits for their injuries arising from the data security incident,” it says.

Under the proposed agreement, Fort Washington, Pennsylvania-based Connexin Software will offer each plaintiff and class member three settlement options: identity theft monitoring for three years, plus up to $1 million in insurance; reimbursement for out-of-pocket losses or time spent as a result of the data security incident up $7,500; or a flat fee cash payment, the amount of which depends on the number of valid claims submitted for that option.

The attorneys are seeking about one-third of the settlement fund, or about $1.3 million, in fees. Connexin is in the process of obtaining funding for the settlement, court documents said.

As of Thursday, the court had not yet set a date for a hearing on the preliminary settlement.

Case Focuses on Impact on Children

According to its website, Connexin makes software “designed by pediatricians for pediatricians with pediatric-specific workflows, templates, and vaccine management functionality.”

An amended complaint filed against Connexin in April 2023 accuses the company of failing to maintain adequate security measures, and it focuses on the impact of the breach on children as well as their parents, guardians and insurance policyholders.

The breach of personal records could saddle these young patients and others with risks of “fraud, identity theft, medical identity theft, misappropriation of health insurance benefits, intrusion of their health privacy” and other types of crimes, the plaintiffs argued.

“The consequences of Connexin’s misconduct and violations of law have had and will continue to have serious consequences for large numbers of young people across the nation,” the amended lawsuit alleges.

Connexin said in a breach notice that on Aug. 26, 2022, it had detected “a data anomaly” on its internal network. Its investigation determined that an unauthorized party had been able to access an offline set of patient data used for data conversion and troubleshooting. Some of that data was removed by the unauthorized party (see: Pediatric EMR Vendor Hack Affects 2.2 Million).

The breach affected a wide range of patient information such as patient name, guarantor name, parent/guardian name, address, email address and birthdate, Social Security numbers, health insurance information, medical and treatment information, and billing and claims data.

Attorneys representing the plaintiffs and class members in the lawsuit did not immediately respond to Information Security Media Group’s request for comment.

Neither an attorney representing Connexin nor the company immediately responded to ISMG’s requests for comment and additional details, including how the case affected the company financially.

Settlement Considerations

The financial condition of Connexin and the possibility that the firm would declare bankruptcy was a legitimate factor in the settlement amount and timing, said regulatory attorney Rachel Rose, who is not involved in the case.

“One item to consider when a company says, ‘We’ll file for bankruptcy unless you settle,’ is whether it is an illegal use of the Bankruptcy Code. That is a separate issue to be litigated,” she said.

“If a company was genuine about this position, then they would have the financial documentation, including revenues lost since the breach, to substantiate the threat of bankruptcy. Opposing counsel should always drill down before relying on potential for bankruptcy,” Rose said.

Heightened Risks for Minors

In the bigger picture, data security incidents such as the Connexin breach that involve compromises of information pertaining to minors raise other serious concerns, Rose said.

“Pediatric patients are particularly vulnerable because not only can their information be utilized – depending on the brazenness of the cyberattacker, they could sell it to a human trafficking organization, which could lead to more unlawful conduct,” she said.

Federal authorities in the U.S. have taken action in some breach cases involving the compromise of children’s data.

Last year, the Department of Justice hit a now-defunct web hosting firm, Jelly Bean, with a $300,000 settlement in a case involving a breach that exposed the information of hundreds of thousands of minors’ insurance applications for low-cost health and dental plans in Florida (see: Feds Fine Web Hosting Firm in Kids Insurance Site Hack).

“Like psychiatric records, minors absolutely have a heightened sensitivity. It may also be more valuable on the black market, which is why pediatric hospitals have been targeted with increased frequency,” Rose said.

Other Pediatric Hacks

Earlier this month, a ransomware group hit Ann & Robert H. Lurie Children’s Hospital of Chicago with a cyberattack that forced the pediatric medical center to take many of its IT systems – including email, phone and electronic health records – offline.

On Wednesday, in an updated statement about the incident, the hospital said its inbound and outbound email to and from external email addresses has been restored, and so have a majority of its phone lines.

But the hospital’s MyChart patient portal still remains offline. “As an academic medical center, our systems are highly complex, and these incidents can take time to resolve. Our network systems’ restoration is ongoing and progressing,” the hospital said.

While Lurie Children’s has said that the incident involved access “by a known criminal threat actor,” the hospital has not yet publicly commented on whether patient records were stolen in the attack.