KU Health, Epic Sued for Plastic Surgery Data Breach

A class action lawsuit has been filed against the University of Kansas Health System, Lawrence Memorial Hospital, and Epic Systems Corporation after a KU Health physical therapist allegedly accessed private medical records, including nude photos and body measurements, of at least 425 women treated at a Lawrence plastic surgery clinic. The breaches reportedly occurred from February 2021 to February 2023 and involved patients who had no treatment relationship with the therapist. The lawsuit claims the therapist used KU Health credentials to exploit Epic’s electronic records system to view sensitive data without authorization. Plaintiffs accuse the defendants of negligence, breach of contract, invasion of privacy, and other violations, and allege inadequate notification to law enforcement and affected patients. The complaint seeks over $5 million in damages and demands stronger data safeguards. KU Health and Lawrence Memorial Hospital have both stated they are reviewing the lawsuit and prioritize patient privacy.