Akeela Inc. offers mental health and substance use disorder treatment services in Anchorage, AK. This healthcare provider recently agreed to resolve a class action lawsuit associated with a 2023 data breach that exposed the protected health information (PHI) of over 284,000 people.
On or about June 22, 2023, Akeela encountered an IT network disruption. The forensic investigation confirmed unauthorized system access and the theft of administrative files that contain patients’ PHI. The stolen data included these data elements: names, birth dates, Social Security numbers, medical diagnosis and treatment data.
In August 2024, the data breach prompted the filing of the Jessica McRorie v. Akeela Inc. class lawsuit in the United States District Court for the District of Alaska. The lawsuit claimed Akeela’s negligence in failing to protect and safeguard patients’ PHI and personally identifiable information (PII) and not complying with the standard data security practices in the health industry. This is even though Akeela knew about the threat of cybercriminals actively targeting healthcare organizations. The lawsuit alleges that Akeela poorly managed sensitive information, and the negligence resulted in the theft of sensitive patient information by cybercriminals.
Additionally, upon identification of the data breach, Akeela deferred issuing breach notification letters to the impacted people. The provider sent the notification letters to the victims more than one year after the discovery of the data breach. The legal action states that the delay reduced the ability of the plaintiff and class members to promptly and completely mitigate and deal with the harms caused by the data breach.
The lawsuit alleges the plaintiff and class members have experienced real injuries because of the data breach, such as financial expenses from mitigating the risk and impending risk of identity theft and fraud, actual identity theft and fraud, lost time and output, privacy violation, diminished value of their private data, and emotional stress, anxiety, and worry. Besides negligence and negligence per se, the lawsuit claims breach of fiduciary duty, breach of implied contract, unjust enrichment, and violation of privacy.
Akeela does not admit wrongdoing and rejects all the claims and disputes in the lawsuit; nevertheless, the healthcare provider decided to resolve the lawsuit to stop other legal expenses and the uncertainty of a trial. Particulars of the settlement deal have not yet been announced to the public; nevertheless, the plaintiff and Akeela have talked about an appropriate settlement. The necessary things are being prepared, including the motion for the court’s preliminary approval and notices for class members.