JRI Class Action: Patients Sue Over Data Breach and Delayed Notification

A class action lawsuit accuses Justice Resource Institute (JRI) of negligence in a data breach that exposed patients' sensitive information.

Consumers Affected: Patients whose personal and medical information was compromised in the JRI data breach.

Court: U.S. District Court for the District of Massachusetts.

Nonprofit provider of outpatient mental and physical healthcare services Justice Resource Institute Inc. (JRI) has been hit with a class action lawsuit alleging it’s responsible for a major data breach that exposed a woman’s sensitive health information, and the information of other patients.

Plaintiff Lisa Anderson filed the class action lawsuit complaint against JRI on July 19 in a Massachusetts federal court, alleging negligence and violations of state and federal consumer laws. 

The lawsuit alleges JRI failed to properly secure and safeguard sensitive personal health information (PHI) and personally identifiable information (PII) of its patients, resulting in the information falling into “criminal cyberthieves’ possession.” 

JRI Accused of Failing to Protect Patient Data, Leading to Massive Breach

Anderson accuses JRI of negligence in handling the private information of its patients, which includes sensitive data such as names, addresses, Social Security numbers, health insurance details, and medical records. 

She says JRI did not adopt “reasonable measures” to protect this information, breaching its duty to safeguard it against unauthorized access.

According to JRI’s own “Notice of Data Security Incident,” an unauthorized party accessed their information technology network around Feb. 15 this year, the lawsuit says. 

The breach was discovered after an internal investigation found that hackers had stolen data containing sensitive patient information, the company said. JRI reported the breach to the U.S. Department of Health and Human Services on April 26, and indicated that 23,118 patients were affected.

Delayed Notification Leaves Patients Vulnerable, Lawsuit Claims

Anderson called out JRI’s delay in notifying the affected patients.

“Defendant waited over four months to notify or warn Plaintiff and Class Members that their Private Information had been compromised, diminishing Plaintiff’s and Class Members’ ability to mitigate harms resulting from the Data Breach during that period,” she says. 

This significantly diminished their ability to mitigate the potential harm, the lawsuit states.

The compromised data can have severe consequences, including identity theft and financial loss. Victims must now invest considerable time and resources into monitoring their credit and financial accounts to prevent or address identity theft, the lawsuit alleges.

It also states that JRI’s data security practices were inadequate, leaving sensitive information exposed to hackers.

“Defendant failed to adequately protect Plaintiff's and Class Members’ Private Information––and failed to even encrypt or redact this highly sensitive information.” 

This negligence, according to the plaintiff, directly led to the breach.

Anderson is looking to represent anyone whose data was exposed in the breach, and seeks certification of the class action, damages, fees, costs and a jury trial. It also demands JRI improve its data security practices. 

Earlier this month, SouthCoast Medical Group was hit with a class action lawsuit alleging negligence in a data breach that exposed patients' personal and medical information, allegedly leading to identity theft and fraud.

Case Details

• Lawsuit: Anderson v. Justice Resource Initiative Inc.
• Case Number: 1:24-cv-11856-IT 
• Court: U.S. District Court for the District of Massachusetts

Plaintiffs' Attorneys

• Christina Xenides (Siri & Glimstad LLP) 
• Kenneth J. Grunfeld,  Jeff Ostrow (Kopelowitz Ostrow Ferguson Weiselberg Gilbert) 
  

Were you a patient at Justice Resource Institute (JRI)? Share your experience and thoughts on this data breach in the comments below.