Change asks to consolidate dozens of cyberattack class-action lawsuits

Twenty-four cases have racked up so far against the UnitedHealth subsidiary following a cyberattack against the technology firm in late February.

Article By: Emily Olsen

Blog Source From : https://www.healthcaredive.com/

Dive Brief:

• Change Healthcare wants to consolidate 24 class-action lawsuits it faces in the wake of a cyberattack that’s caused disruptions across the industry, according to a Wednesday court filing. 
• The UnitedHealth Group subsidiary asked a judicial panel to combine the suits and centralize them in the federal U.S. District Court for the Middle District of Tennessee — where Change is headquartered — arguing the cases share factual and legal claims and are in early stages of litigation.
• Consolidating would preserve court resources and avoid duplicative work and inconsistent rulings, Change said in the filing. 

Dive Insight:

Lawsuits are piling up against Change as the technology company works to bring all of its systems back online following a cyberattack in late February.

Two dozen class-action lawsuits related to the cyberattack have been filed as of April 2, according to the court filing. Thirteen were filed by consumers citing concerns about data theft, while 11 came from providers who said they struggled to receive payments while Change’s systems have been offline. 

The technology firm pushed back against the suits, arguing the cases are based on the “incorrect and unfounded theory” that Change’s security wasn’t adequate, and plaintiffs must have been harmed by the attack. 

Lawsuits could proceed in at least seven districts across the country if the cases aren’t centralized.

Change suggested the Middle District of Tennessee for a consolidated case, arguing the technology company, which was acquired by healthcare conglomerate UnitedHealth in 2022, was at the center of all the lawsuits, even those that named other entities like UnitedHealth or health services arm Optum.

Most of the suits filed so far have already been filed in Tennessee, and the judge who would likely be assigned is “well-equipped” to handle the case, the filing said. 

Data breach class actions “exploded” in 2023, according to a February report from law firm Duane Morris, as the healthcare industry faces increased breach threats. The HHS’ Office for Civil Rights tracked a 256% increase in large breaches over the past five years. 

A major data breach last year at a medical transcription services vendor, Perry Johnson & Associates, led to a number of lawsuits against the company and affected health systems. The lawsuits were recently consolidated in the Eastern District of New York. 

UnitedHealth did not respond to a request for comment.