Updated: Lawsuit alleges cybersecurity failures by hospital; Social Security numbers among compromised data
The lawsuit, filed March 4, also alleges Frederick Health "deprived [people] of the chance to mitigate their injuries" by failing to notify them of the data breach until Feb. 6 — 10 days after the attack on Jan. 27.
'Frederick Health can confirm that it is the subject of a suit pertaining to the cyber event that occurred earlier this year. While we cannot comment on the specifics of the ongoing legal proceedings at this time, we want to assure our patients and the community that we take this matter seriously, and we are fully committed to resolving this issue responsibly and with integrity," a statement by FHH spokesperson Josh Faust said on Friday. "Frederick Health and our legal team are cooperating with officials to review the claim. Our priority remains to positively impact the well-being of every individual in the community and to continue to protect and safeguard the security of our systems and the information we maintain.'
He declined to comment further.
On Jan. 27, FHH identified a ransomware attack. Tom Kleinhanzl, the hospital's president and CEO, said an unauthorized person gained access to and copied documents from a shared drive, which he described as an electronic storage closet for important historical information.
The documents contained information such as patients' names, Social Security numbers, birthdays and addresses.
He said FHH's electronic medical records system, patient portal and emails were not accessed in the attack. The hospital still took the rest of its systems offline proactively as a precaution.
The lawsuit was filed on behalf of two "customers" of Frederick Health, as well as any others affected by the ransomware attack, according to court documents.
Frederick Health has been unable to determine the full extent of the data breach, the suit alleges.
The stolen information is "one of the most valuable commodities on the criminal information black market," the suit says. The information's presence on the "dark web" could result in financial harm for Frederick Health customers, as well as their identities being stolen.
Frederick Health's failure to implement "reasonable and appropriate" cybersecurity measures violated federal consumer protection laws, the suit alleges.
The suit also alleges that Frederick Health "had notice and knew that its inadequate cybersecurity practices would cause injury" to the hospital's customers. Frederick Health deliberately omitted and suppressed the fact that it did not comply with regulations regarding consumer protection, the suit further alleges.
Frederick Health "would have been unable to continue in business and it would have been forced to adopt reasonable data security measures and comply with the law" had it disclosed its vulnerabilities to its customers, the suit alleges.
The suit calls for a jury trial and asks for unspecified monetary and other damages to be paid to those affected.
FHH sends letters
Frederick Health Hospital sent out letters Friday to patients and staff who have been or may be impacted by the ransomware attack.
Kleinhanzl said the letters include instructions for what people should do if they've been impacted. He also said FHH is offering these people free identity theft protection and credit monitoring.
Right after the attack happened, the hospital was diverting ambulances to take patients to other emergency departments.
For several weeks, staff members were using "downtime procedures" and recorded everything on paper since they couldn't use electronic systems.
FHH slowly brought its systems back online over several weeks, with its electronic medical records system being restored on Feb. 18. The hospital announced on March 4 that its patient portal was back up.
Kleinhanzl said he could not comment further on the unauthorized person, the investigation into the attack and what law enforcement agency is working with FHH due to active litigation.
The FBI told The Frederick News-Post on Feb. 4 that it can neither confirm nor deny it is investigating the ransomware attack at FHH.
Kleinhanzl said a "substantial number" of notification letters are being sent out to current and former patients and staff, but he declined to comment on how many letters were being delivered.
Due to the personal information that is in the shared drive, "that's why we felt compelled to be very broad in the distribution of this notification," he said.
He also said the hospital will continually evaluate and modify its security and privacy practices to protect people's information and still has extensive security measures in place.
"We take our role seriously, very seriously, in this community of doing everything we possibly can to protect information, and we want to make sure we're doing right by everyone we can to give an option of protection," Kleinhanzl said.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Yahoo
18-07-2025
- Yahoo
Michigan civil rights and health advocates condemn deal to share Medicaid data with ICE
An Immigration and Customs Enforcement officer's badge is seen as federal agents patrol the halls of immigration court in New York City on June 10, 2025. (Photo by Michael M. Santiago/Getty Images) A plan to give Immigration and Customs Enforcement access to the personal data of all 79 million Medicaid enrollees – including more than 2.6 million Michiganders – is being condemned by both the American Civil Liberties Union of Michigan and the Michigan League for Public Policy. The Associated Press reports the agreement between the Trump administration's Department of Homeland Security and the Centers for Medicare and Medicaid Services would include the home addresses and ethnicities of enrollees in an effort to track down immigrants who may not be living legally in the United States. The AP obtained a copy of an agreement between the two agencies, which has not been publicly announced. Ramis Wadood, an ACLU of Michigan staff attorney, noted the policy change comes on the heels of Congress, at the behest of President Donald Trump, approving nearly $1 trillion in cuts from Medicaid. SUBSCRIBE: GET THE MORNING HEADLINES DELIVERED TO YOUR INBOX 'Now, this wicked administration intends to terrorize Medicaid enrollees by sending ICE agents to their doors to possibly drag them away from their families in the name of rounding up people believed to be in the country illegally,' Wadood said. According to a joint press release by the ACLU and the Michigan League for Public Policy, the agreement is believed to be the first time in Medicaid's history that comprehensive health data, including names, birthdates, addresses, Social Security numbers, and racial and ethnic information, has been turned over for immigration enforcement. 'Sending ICE the personal data of 79 million people will put them in the crosshairs of the Trump administration's senseless and dehumanizing mass deportation machine. The attacks on our immigrant friends and neighbors, as well as the millions on Medicaid, are an affront to all of us – our rights and our freedom – and together, we must fight back,' Wadood said. Monique Stanton, president and CEO of the Michigan League for Public Policy, called the policy a 'direct attack' on public health and civil liberties. She also warned that it will deter families — including those legally eligible — from seeking even emergency treatment out of fear that their enrollment could result in detention or deportation. 'When a parent brings their child to the ER, they shouldn't have to weigh whether saving their child's life will put their entire family at risk of deportation. Weaponizing Medicaid data for immigration enforcement will create a dangerous chilling effect, deterring immigrants and their families from seeking the care they need, while putting entire communities at risk,' Stanton said. According to the joint press release, Michigan is home to over 157,000 residents living in mixed-status families, including more than 71,000 U.S. citizens. 'These families already face elevated rates of uninsurance — 10.6% of immigrants in Michigan are uninsured, compared to just 5% of native-born residents. Policies that increase barriers to care will only worsen health disparities and strain emergency services,' the release stated. Both agencies also say the data-sharing arrangement raises serious legal and ethical concerns, and appears to violate federal medical privacy protections, including the Health Insurance Portability and Accountability Act, known as HIPAA. The AP reported that Medicaid officials had fought to prevent the data sharing even as late as Monday. 'They are trying to turn us into immigration agents,' a CMS official, who did not have permission to speak to the media and insisted on anonymity, told the AP. Stanton said the implications of sharing the data go beyond immigration policy. 'Delays in prenatal and pediatric care could lead to preventable birth complications and childhood illnesses. Avoiding preventive treatment will drive up emergency costs for hospitals and taxpayers. And the mental health toll from fear, trauma and family separation will ripple across generations,' Stanton said. 'We cannot allow this betrayal of trust to stand.' Solve the daily Crossword
The Hill
18-07-2025
- The Hill
ICE will soon have nation's Medicaid data: What to know
The personal health information of 79 million people will soon be in the hands of Immigration and Customs Enforcement (ICE) officials, who will use the data trove to find undocumented migrants in the U.S. amid President Trump's immigration crackdown. ICE plans to use the nation's Medicaid database to 'receive identity and location information on aliens identified by ICE,' according to an agreement obtained by The Associated Press. Information available to ICE officials will include: Addresses Birthdates Ethnic and racial information Social Security numbers The agreement between the Centers for Medicare and Medicaid Services (CMS) and the Department of Homeland Security (DHS) does not allow ICE officials to download the data. Instead, officials will be allowed to access the data for a limited period from 9 a.m. to 5 p.m., Monday through Friday, until Sept. 9. Medicaid is only available to noncitizens in emergencies While immigrants who have entered and remained in the U.S. illegally are not eligible for Medicaid, every state is required to provide emergency Medicaid coverage for life-saving situations. Some states also make exceptions for children and certain adults. That means, despite not qualifying for the federally funded coverage, some noncitizens' information is still available in Medicaid records. The Kaiser Family Foundation (KFF) estimated that emergency care for undocumented patients accounted for less than 1 percent of Medicaid spending from 2017 to 2023. Democrats, advocates slam ICE-Medicaid data disclosure Politicians and immigrant advocates alike have opposed the agreement due to concerns over data privacy and human rights violations. Sen. Adam Schiff (D-Calif.) said Thursday on social media that 'the massive transfer of the personal data of millions of Medicaid recipients should alarm every American.' Immigration attorney Anibal Romero echoed Schiff's concerns. 'So eventually, what could end up happening is someone might transfer information about … a U.S. citizen, with a Latino name, and all of a sudden, now I have ICE officers in my house, even though I was born here only because my name is Raul Lopez,' Romero told NewsNation. 'So, it's scary. I think it's wrong.' Early this month, a coalition of 20 Democrat-led states sued the Trump administration over the agreement. California Attorney General Rob Bonta (D) said it has 'created a culture of fear that will lead to fewer people seeking vital emergency medical care.' 'We're headed to court to prevent any further sharing of Medicaid data — and to ensure any of the data that's already been shared is not used for immigration enforcement purposes,' he added. In a statement, DHS spokesperson Tricia McLaughlin said the agencies are 'exploring an initiative to ensure that illegal aliens are not receiving Medicaid benefits that are meant for law-abiding Americans.' The White House has deferred questions about the agreement to ICE.
Health Line
17-07-2025
- Health Line
Divorced Spouse Eligibility for Medicare
You're eligible for Medicare if your current or former spouse has worked in the United States and paid taxes for at least 10 years. Whether or not you'll pay a premium for Part A depends on a few more factors. Original Medicare includes Part A, which is hospital insurance, and Part B, which is medical insurance. Once you qualify for Part A, you can also sign up for Part B. If you're married or were married to someone who meets the eligibility criteria, you should still qualify for Original Medicare, even if you don't meet the requirements yourself. That said, depending on some criteria, you may have to pay a premium for Part A. Read to learn how you can qualify for Medicare after divorcing a beneficiary spouse and what you need to know about potential costs. Can a divorced spouse get benefits from Medicare? Generally, you're eligible for Medicare if you're over 65 or younger and receive Social Security Disability Insurance (SSDI) as long as you've worked in the United States and paid taxes for at least 10 years. However, if you're divorced and ineligible for Medicare, you may still qualify for Medicare through your former spouse's eligibility, provided your marriage lasted at least 10 years. Similarly, if you're widowed, you can qualify for your deceased spouse's Medicare if you are currently single, were married for at least 9 months before their passing, and they qualified for Social Security benefits. How do I qualify for divorced spouse benefits? If you were married to your beneficiary spouse for at least 10 years, you're also eligible for Medicare. However, most people don't pay a premium for Part A. Whether you'll have to pay it depends on your former spouse's work and tax history as well as a few other factors. You can receive Medicare Part A without any cost at the age of 65 based on your former spouse's work history if you fulfill these requirements: Your marriage lasted a minimum of 10 years. You're currently not married. Your former spouse is at least 62 years old and qualifies for Social Security or Railroad Retirement Board (RRB) benefits. You qualify for Social Security benefits through your former spouse's work record, even if you haven't applied for them yet. If your former spouse has passed away, you may still be eligible for premium-free Part A as a divorced surviving spouse if: You're 65 years old or older, or you're younger and meet disability eligibility criteria. Your marriage lasted at least 10 years. You're currently unmarried. Your former spouse had sufficient work history under Social Security or in a Medicare-covered government job. If you don't meet these criteria, you can still get Part A by paying a monthly premium during specific enrollment periods. Even if eligible through your former spouse, you must enroll separately. How much does Medicare cost if I'm divorced from my spouse? Even with premium-free Part A, you'll still have to meet a deductible before you get coverage. In 2025, this is $1,676. Once you're eligible for Part A based on your former spouse's eligibility, you are then eligible to purchase Medicare Part B (medical insurance) for a monthly premium, which in 2025 starts at $185. You then also have the option of signing up for Medicare Advantage (Part C), which is an alternative to Original Medicare (parts A and B), and for Medicare Part D, which covers prescription drugs. The costs of these privately run plans vary by plan. As with Part A, each spouse must enroll and pay for their own Medicare Part B, C, or D plan. Takeaway Original Medicare consists of parts A and B. If you're divorced from someone who meets the eligibility criteria, you should still qualify for Original Medicare as long as your marriage lasted 10 years, even if you don't meet the requirements yourself. However, depending on how your former spouse qualifies for Medicare, you might need to pay a premium for Part A. After obtaining Part A, you can enroll in the other parts of Medicare. The information on this website may assist you in making personal decisions about insurance, but it is not intended to provide advice regarding the purchase or use of any insurance or insurance products. Healthline Media does not transact the business of insurance in any manner and is not licensed as an insurance company or producer in any U.S. jurisdiction. Healthline Media does not recommend or endorse any third parties that may transact the business of insurance.
