Class Actions Surge Against American Vision Partners Following Major Data Breach

All eyes are on American Vision Partners, one of the country’s largest eye care physician services organizations, after the personal health information of more than 2.3 million people was accessed in a data breach. 

At least three groups of those consumers have followed up by filing proposed class action lawsuits, accusing the company of being haphazard with sensitive data and not taking the appropriate safety measures to protect it, HIPAA Journal reports.

The breach

Medical Management Resource Group LLC, doing business as American Vision Partners, serves communities throughout Arizona, Texas, New Mexico, Nevada, and California, according to its website, and has more than 130 nationally recognized doctors and more than 100 eye care centers, including 25 ambulatory surgery centers and 25 satellite clinics. 

In November last year, the company discovered a breach of its systems that compromised the personal information of 2,350,236 people, including their names, contact information, dates of birth, medical information, clinical records, Social Security numbers, and health insurance information.  People affected by the breach were alerted last month via a letter, and offered free credit monitoring services. 

However, for many some patients that offer just didn’t cut it. In the last week of February, three proposed class action lawsuits were filed in Arizona with patients accusing Medical Management Resource Group of failing to protect their information by lacking appropriate cybersecurity measures.

American Vision Partners not alone

The breach comes hot on the heels of a major cyberattack on healthcare payment provider Change Healthcare, that we recently reported on.  The payment provider is also facing a growing number of proposed class action lawsuits following the major breach that saw systems knocked offline, with ongoing fallout for the healthcare industry, and a massive breach of customers’ data.

In September, the U.S. Department of Health and Human Services’ Office for Civil Rights announced it had reached a settlement with LA Care, who agreed to pay $1.3 million and implement a corrective action plan to better protect the security of electronic protected health information after data breaches.

Meanwhile, Tennessee Orthopaedic Clinics offered patients affected by a data breach up to $4,000 each as part of a settlement agreement after a cyberattack, HIPAA Journal reported.

Increase in hacking of healthcare information 

Unfortunately, cyberattacks on the healthcare industry are on the rise, and so too are lawsuits trying to recover losses from said attacks, as Bloomberg Law reported. A Bloomberg Law analysis found the monthly average of new class action lawsuits filed over health data breaches in 2023 was nearly double the rate from the previous year. 

Meanwhile the rate of actual breaches has more than doubled between 2023 and five years ago, HIPAA Journal reported, with an average of 1.99 healthcare data breaches of 500 or more records were reported each day in 2023.  On average, 364,571 healthcare records were breached every day, the outlet reported.

National Law Review said in response to the rise in cyber-threats within the healthcare industry, businesses needed to be proactive in mitigating or preventing the growing threat, sharing some tips including adopting risk analysis and management practices. The National Library of Medicine said in a 2020 report healthcare organizations could employ several strategies to enhance the security of their databases, including having a backup, using firewalls, Firefox technology, and encryption.