A class action lawsuit alleges that an unauthorized physical therapist employed by KU Health repeatedly accessed the private medical records and photos of 425 Lawrence Memorial Hospital patients over the span of two years.
According to court documents filed Tuesday in federal court, the physical therapist, then employed by the University of Kansas Health System, used his credentials to open the private medical files through an electronic health records portal that permitted data sharing between unrelated medical agencies.
KU Health, LMH Health and Epic Systems Corporation, the developer of the medical records platform, are facing 13 counts of privacy violations, fraud and negligence.
Beginning as early as February 2021, the physical therapist reportedly targeted female patients of Plastic Surgery Specialists of Lawrence, an affiliate of LMH, who had undergone breast augmentation and related procedures.
The available data within the records contained health and clinical information as well as sensitive personal information including names, dates of birth, Social Security numbers and insurance information. Because of the nature of the treatment, the files also contained photographs, as described on behalf of one of the two individuals whose experiences are detailed in the complaint.
“Plaintiff Doe #1’s surgeon at LMH took pre-operative and post-operative photographs of her entire nude body from multiple angles, including photos of her chest and genital area,” the lawsuit states. “Several of these photographs include Plaintiff Doe #1’s face, both with and without a surgical mask.”
Don’t miss a beat … Click here to sign up for our email newsletters
Click here to learn more about our newsletters first
The complaint recounts what happened to two female patients who underwent treatment at Plastic Surgery Specialists between 2021 and 2023. Jane Doe No. 1 is identified only as a resident of Riley County, and Jane Doe No. 2 resides in Platte County, Missouri.
According to court documents, the first woman became aware of the problem after receiving a letter from KU Health in April 2023 — approximately two months after KU allegedly discovered the data breach. The letter stated that both personal information and medical records had been compromised by an employee who was not authorized.
The letter identified the employee only as a physical therapist and said his employment had been terminated. The letter did not include the number of patients affected, nor did it clarify what data had been accessed, where the data originated or whether it was copied or shared.
Although both women had received care through KU Health in other instances, none of the services provided through Plastic Surgery Specialists involved other medical providers or physical therapists. “Out of an abundance of caution,” Doe No. 1 contacted her plastic surgeon to determine whether files associated with those procedures were among those mentioned in the letter.
“To Plaintiff Doe #1’s shock and dismay, her surgeon informed her that [the] physical therapist had keystroked her name, letter-by-letter, multiple times during the period of the privacy invasions and that [the] physical therapist was able to access her medical records at LMH.”
The lawsuit states that the surgeon would not answer definitive questions about what was breached, but confirmed that her personal information, files and photos were “sistered in” to KU Health’s system.
In May 2023, Doe No. 1 met with KU Health representatives, who had compiled samples of what was accessed.
“The packet showed that [the] physical therapist had taken at least one screenshot of plaintiff Doe #1’s information — her driver’s license — after [the] physical therapist had viewed it twice,” court documents state.
The sample showed that the physical therapist had searched specifically for her and her medical file, which included personal records going back to at least 2010, according to the lawsuit.
KU Health allegedly refused to give her a copy of the information. Since that meeting, neither KU Health nor LMH has provided any additional information to Doe No. 1.
Doe No. 2 was also alerted to the breach through the April 2023 letter. Although she also contacted both KU Health and LMH, she received even less information than Doe No. 1.
Court documents state that there is no evidence that the physical therapist was ever “investigated, arrested, or charged in connection with his conduct. No disciplinary action has been reported by the Kansas Board of Healing Arts, and no law enforcement agency appears to have taken action against him to date.”
The allegations against KU Health, LMH and Wisconsin-based Epic assert that by choosing to create or participate in records exchange systems enabling cross-organization access to patient records, those agencies assumed responsibility for maintaining strict access controls.
The complaint states that the rights and privacy of the plaintiffs were violated through the negligence of KU Health and LMH, and their lack of oversight of an employee. It says LMH never disclosed the physical therapist’s conduct at all until the plaintiffs reached out.
Because of these violations, the plaintiffs have suffered “profound emotional and psychological trauma,” anxiety when seeking medical treatment, and fear that they are being stalked. They also detail their current and future risk of identity theft and financial fraud.
Mimi Meredith, a spokesperson for LMH Health, provided an emailed statement Thursday morning.
“LMH Health was made aware this morning that it is one of three parties named in a lawsuit alleging violations of patient privacy,” Meredith said. “While we can’t comment on ongoing legal action, we want to reassure our patients and community that we take any suspected violation of patient privacy extremely seriously. This claim is under review by legal counsel, and we will keep the community apprised of any additional facts we can share as they become available.”
The plaintiffs are seeking a jury trial in Kansas City, Kansas. They are asking the court to issue a permanent injunction “to prohibit and prevent KU Health, LMH, and Epic from continuing to engage in unlawful acts, omissions, and practices described herein,” damages in an amount to be determined at trial and more.
The complaint was filed by J. Austin Moore, an attorney with Kansas City, Missouri-based Stueve Siegel Hanson, LLP.
If our local journalism matters to you, please help us keep doing this work.
Don’t miss a beat … Click here to sign up for our email newsletters
Click here to learn more about our newsletters first
Andrea Albright (she/her), reporter, can be reached at aalbright (at) lawrencekstimes (dot) com. Read more of her work for the Times here. Check out her staff bio here.
Latest Lawrence news:
August Rudisell/Lawrence Times
Nathan Kramer / Lawrence Times
City of Lawrence cites potential loss of $8M in federal funds as reason for resolution that sparked uproar
The City of Lawrence is “exploring the risks associated with potentially losing $8M in funding,” according to a statement regarding a draft resolution that pledged the city would stop enforcing its equal rights ordinances in order to comply with Trump’s executive orders.
