Mother files lawsuit against Rady Children's Hospital over data breach

Woman said daughter's information compromised

SAN DIEGO - A local mother is filing a lawsuit against Rady Children's Hospital after what her attorney called a massive security breach.

The mother, who did not want Team 10 to use her name in order to protect her daughter's identity, said the hospital released sensitive information about her daughter's sexual assault.

"When she was 11, she was attacked by a man in a bathroom at a park. He held a knife to her and raped her," said the mother.

She said her daughter didn't tell her what happened for two years.

"She started cutting and having a complete breakdown. She ended up in Rady because she took too many pills," she said.

The girl received treatment and counseling while she was at the hospital.

"It's information that you never want anyone to know, ever," said the mother.

This summer, the mother said she received a phone call from a supervisor at Rady Children's Hospital. The mother learned her daughter was among 20,000 patients that had their medical records accidentally sent to several job applicants through two security breaches.

"The lady that called, I asked for her last name. She said, 'No, sorry, we can't give out that information,'" said the mother.

Attorney David A. Miller, who is representing the mother, said, "This is not one or two records dropped in the parking lot. The people they gave this information to didn't even work there. They were job applicants."

The mother was also sent a letter from Rady Children's Hospital about the breach. A few weeks later, another letter was sent to their home but it was addressed to her daughter.

The letter to her daughter was from a company they never heard, and it asked the girl to participate in a medical study about depression.

"Two weeks after we get the letter from Rady and we start getting mail addressed to her from depression. It's so obviously connected," she said.

Miller and his client believe the company obtained the information from the security breach.

A spokesman for Rady Children's Hospital told Team 10 that no street or email addresses were on the spreadsheets sent to the applicants.

The hospital does not believe the medical company received her information through the security breach.

Miller said the hospital still broke the law, and he filed a lawsuit over breach of privacy and breach of the Medical Records Confidentiality Act.

"It's more than sad. It's pathetic that this type of breach could happen on this scale, especially to children," said Miller.

Rady Children's Hospital officials said they contacted the required regulatory agencies over this issue.

No legal determination has been made over liability or fines regarding the breach.

Print this article Back to Top