Rochester-area family sues over compromised medical records

Listen to this article

A Rochester-area family is suing a nurse for improperly accessing their medical records.

Rochester attorney Derrick A. Spatorico filed the lawsuit in state Supreme Court on behalf of plaintiffs Mary E. Hurley and her husband, Daniel M. Hurley, and their three children.

Originally, the defendants in the lawsuit included Rochester Regional Health ACO Inc. (RRH), Rochester General Hospital (RGH), Greater Rochester Independent Practice Association Inc. (GRIPA), and Christine M. Smith.

But state Supreme Court Justice Elena F. Cariola last month granted a motion to dismiss the complaint against RRH and GRIPA because Smith was not employed by either of those organizations and the accessing of the records was not done in the scope of her duties as an employee by them.

Spatorico has filed a notice that he is appealing that decision to the Appellate Division of state Supreme Court, Fourth Department.

According to the complaint, Smith was employed as a registered nurse by RRH, RGH, and GRIPA when she reviewed about 670 confidential medical records of Mary Hurley on 36 separate days from Oct. 7, 2017, through April 26, 2022.

The suit also claims Smith reviewed the confidential medical records of Daniel Hurley on March 11, 2018, and April 4, 2020.

And the suit claims that Smith accessed the confidential medical records of the Hurley’s children on 10 dates between May 5, 2018, and May 18,2021.

“Smith did not possess any legitimate reason or basis for accessing and reviewing the confidential medical records of (the Hurley family) for which she was not in any way directly or indirectly involved in their treatment or the processing of any medical insurance claims by them,” according to the complaint.

In June 2022, the Hurleys received letters from Rochester Regional Health

“As part of a recent audit we found questionable access into your medical record by our employee,” Elizabeth Wild, senior manager of privacy, wrote to Mary Hurley.

“You contacted my office after the employee reached out to you regarding the investigation. Although the employee stated that she had accessed your medical record per your request, you stated that you had not made such a request,” Wild wrote.

“As a result of this incident, we have taken the appropriate level of disciplinary action with the employee,” Wild wrote.

A similar letter was sent to Daniel Hurley regarding the improper review of his records and the records of the children.

In a separate recently filed complaint seeking class-action status, GRIPA is being sued because thousands of patients had their personal information compromised in a breach of the organization’s computer system.

GRIPA is “a physician led partnership between the eight affiliate hospitals of Rochester Regional Health and more than 1,500 physicians in western New York, the Finger Lakes region, and St. Lawrence County,” according to the complaint filed in state Supreme Court in Rochester.

In that case, “unauthorized third-party cybercriminals” accessed the information of patients stored on the GRIPA’s computer network with the intention of misusing the information, “including marketing and selling” the information, according to the suit.

GRIPA officials said their organization was among 2,500 entities that were targeted by a simultaneous cyberattack.

“We continue to monitor this situation closely and we are not aware of any misuse of any personal information that may have been compromised as a result of this incident,” GRIPA officials said.

Editor’s note: The author of this article has been notified that he is among the people affected by the cyberattack on GRIPA.

[email protected] / (585) 232-2035