Class action lawsuit worth $5 million against Geisinger and Microsoft-owned IT company

DANVILLE, Pa. (WTAJ) – A class action lawsuit has been filed against Geisinger and a Microsoft company seeking $5 million in compensation for patients over a data security breach.

A former patient, James Wierbowski, filed the lawsuit personally and on behalf of more than a million affected Geisinger patients, claiming that a former Nuance Communications employee accessed their private health data. Nuance, which is owned by Microsoft, provides AI-powered healthcare IT services to about 10,000 healthcare organizations worldwide, including Geisinger, according to the lawsuit.

In the lawsuit, Wierbowski alleges that Geisinger, a Danville-based health system in Pennsylvania, discovered that a former Nuance employee, Max Vance, had accessed patient data two days after he was fired. The lawsuit also alleges that after notifying Nuance of the data breach, Vance revoked access to the records.

The data breach was allegedly discovered on November 29, 2023. According to the lawsuit, various patient information was accessed, including names, date of birth, address, admission and discharge or transfer code, medical record number, race, gender, phone number, and facility name abbreviations.

Wierbowski claims that patients were not informed until six months after the data theft and warned that criminals could sell stolen patient data on the black market.

On June 24, Geisinger released an official statement. In the press release, Geisinger reported that law enforcement investigators had asked Nuance to delay notifying patients about the incident.

“The privacy of our patients and members is our top priority and we take protecting it very seriously,” Jonathan Friesen, Geisinger’s privacy officer, said in a June 24 statement. “We continue to work closely with authorities in this investigation and while I am grateful that the perpetrator was caught and is now facing charges in federal court, I am sorry that this happened.”

The lawsuit alleges that Nuance should have immediately terminated Vance’s security clearance and accuses Nuance and Geisinger of negligence and breach of their fiduciary duty and implied contract with Geisinger’s patients.

Wierbowski is demanding $5 million in the class action lawsuit.

More information about the lawsuit can be found below.