Cases Archives - Keller Grover

Essilor

Whistleblower Kristie Rudolph filed a whistleblower lawsuit under the California Insurance Frauds Prevention Act in 2016 alleging that her former employer, Essilor Laboratories of America, Inc., alleging that Essilor provided unlawful kickbacks to eye care providers in exchange for business from those providers. These kinds of unlawful incentives, which drive up the costs of insurance for all Californians, are illegal under California law. The California Insurance Frauds Prevention Act, California Insurance Code sec. 1871.7, allows individuals like Ms. Rudolph to file a qui tam lawsuit against anyone who commits insurance fraud in the State of California. Ms. Rudolph was represented in this case by Baron & Budd, P.C. The Weiser Law Firm and Keller Grover LLP.

The California Department of Insurance intervened in Ms. Rudolph’s case in 2021 after an extensive investigation. The California Department of Insurance, together with Ms. Rudolph’s legal team, successfully opposed Essilor’s efforts to knock the case out. The parties subsequently agreed to a settlement in November 2022 under which Essilor agreed to pay $23.8 million to resolve the case.

See press release.

Investigation: PIH Data Breach

Keller Grover LLP is investigating a medical data breach involving PIH Health. According to a data breach notification recently sent to affected patients, email accounts of certain PIH Health employees were accessed by unauthorized third parties. Information contained within the breached email accounts included patient names, treatment and diagnosis information, Social Security Numbers, and driver’s license numbers.

Negligent release and disclosure of personal and medical information is unlawful under certain circumstances in California. If you have been affected by a medical data breach, including the PIH Health data breach, you may be entitled to seek damages relating to the disclosure of your personal and medical information. Keller Grover is experienced in the field of medical information privacy litigation and has represented clients in numerous medical data breach class action cases, including lawsuits against St. Joseph Health Systems, Stanford Hospitals and Clinics, Health Net and 21^st Century Oncology. In aggregate, Keller Grover has helped victims of medical data breaches recover millions of dollars for the harm they have suffered.

If you have any information about the PIH Health data breach or are a California resident that has been affected by the data breach and have questions, contact Keller Grover’s attorneys at 888-535-5291 or by email at info@kellergrover.com. Keller Grover will not charge you for reviewing your information and all information that you provide to Keller Grover in the process of seeking legal advice will be held strictly confidential.

Investigation: Walgreens Medical data breach

Keller Grover LLP is investigating a medical data breach involving Walgreens. According to a data breach notification recently sent to affected patients, sensitive information such as patient names, prescription numbers and drug names, pharmacy locations, and shipping addresses of certain users of the Walgreens mobile app personal secure messaging feature were viewable by other customers using the Walgreen mobile app.

Negligent release and disclosure of personal and medical information is unlawful under certain circumstances in California. If you have been affected by a medical data breach, including the Walgreens data breach, you may be entitled to seek damages relating to the disclosure of your personal and medical information. Keller Grover is experienced in the field of medical information privacy litigation and has represented clients in numerous medical data breach class action cases, including lawsuits against St. Joseph Health Systems, Stanford Hospitals and Clinics, Health Net and 21^st Century Oncology. In aggregate, Keller Grover has helped victims of medical data breaches recover millions of dollars for the harm they have suffered.

Sutter Health

Keller Grover LLP represents Kathy Ormsby in a False Claims Act case originally filed in 2015 and now pending in the United States District Court for the Northern District of California, United States ex rel. Kathy Ormsby v. Sutter Health and Palo Alto Medical Foundation, Case No. cv-15-1062 (JD). Ormsby alleges in her complaint that her former employer, Sutter Health and its affiliate PAMF, defrauded the government as part of its Medicare Part C program, known as Medicare Advantage, through the submission of inaccurate and unsupported medical information which artificially inflated the reimbursement Medicare provides for Sutter’s Medicare Advantage patients. The Complaint alleges that Sutter Health and PAMF defrauded the by claiming its members were treated for conditions they either did not have or were not treated for which increased the risk scores for these patients and how much the government reimbursed Sutter and PAMF for their care.

Medicare pays more to healthcare providers based on enrollees’ -risk adjustment scores, which are calculated using patients’ medical diagnoses. Higher risk adjustment scores are supposed to reflect these patients are sicker than an average patient, and increased risk-adjustment reimbursement is designed to offset increased costs associated with treating these patients.

The Complaint alleges that Sutter Health and PAMF collected and retained payments from claims that falsely stated its patients were treated during the relevant period for:

diagnoses the patients did not have;
more severe diagnoses than the patients had;
diagnoses for which patients were previously treated but that were not treated in the relevant year; and/or
diagnoses that otherwise failed to meet CMS requirements for risk adjustment.

The complaint also states that Sutter Health and PAMF failed to correct previously submitted Medicare risk adjustment claims even though they knew, or should have known, that those claims were false. Under Medicare rules and regulations, the healthcare provider was required to report and reimburse the government for any overpayments.

Sutter Health and PAMF executives, according to the Complaint, suppressed efforts of internal auditors to measure and correct false risk adjustment claims. Allegedly, auditors trying to correct the unsupported higher risk adjustment data and calculate how much Medicare should be repaid were ordered to halt their efforts and to instead concentrate on further increasing the stream of ill-gotten payments.

The Complaint also alleges that Sutter Health and PAMF overstated the patients’ risk scores by conducting a review of patient medical records only looking for missed diagnosis that could be reported as higher risk adjustment scores, instead of looking for both missed and unsupported diagnoses that had falsely inflated risk scores, according to the complaint. Allegedly, when Sutter Health and PAMF audited previously submitted claims, error rates were as high as ninety-five percent (95%), yet, Sutter Health and PAMF management refused to take meaningful steps to identify and rectify the problems with the claims submitted to Medicare.

The complaint also alleges Sutter Health and PAMF had no effective compliance auditing program at all for several years while submitting hundreds of millions of dollars in bills to the Medicare Advantage program, and that although internal audit results warned of serious provider over-coding, Sutter and its affiliate failed to correct errors and return overpayments, but even canceled future audits.

On December 4, 2018, the United States Justice Department filed their notice of intervention. On December 11, 2018, the United States District Court ordered the case unsealed.

Relevant Pleadings:

Other Relevant Information:

DOJ Press Release

More courts allow data breach victims to sue even if they haven’t (yet) suffered fraud

Malware attacks are in the news a lot these days. In some cases, hackers hold victims’ computers hostage in exchange for ransom. In other cases, they quietly install malware on a computer and then use it to siphon away a victim’s private information.

It’s only gotten worse now that the hackers have learned that the big prizes are tucked away inside corporate networks, not individual PCs. One corporate hack can compromise the personally identifiable information (PII) of thousands of employees and customers—information like online passwords, credit card and bank account numbers, and even social security numbers. Hackers can use this information to rack up fraudulent charges, apply for government benefits, and even file phony tax returns in order to collect bogus refunds.

Companies that store PII must take reasonable steps to do so securely. If they fail to live up to this responsibility, victims whose data is exposed can hold them accountable under a host of federal and state laws as well as common-law doctrines like negligence or breach of contract. Additionally, California and other states require companies to quickly inform customers when a data breach has been discovered, and may be held liable if they delay.

Neiman Marcus settles data breach claims

In some data breach cases, a company may discover its network has been compromised before thieves have had a chance to actually use some or all of the stolen PII. Companies defending lawsuits in such situations have tried to get the cases dismissed, arguing that customers whose PII hasn’t been used lack “standing” required to sue because they haven’t suffered compensable harm.

Thankfully for consumers, courts across the country are increasingly denying companies this easy out. For instance, an Illinois federal judge recently gave preliminary approval to a $1.6 million settlement in a case against luxury retailer Neiman Marcus. In 2013, hackers allegedly installed malware on the luxury retailer’s computer networks and “scraped” payment information from several stores.

It took three months for Neiman Marcus to discover and remove the malware. A total of around 370,385 credit cards were exposed. The hackers ultimately used around 9,200 card numbers to rack up fraudulent charges.

Earlier in the case, Neiman Marcus had argued that the plaintiffs had no standing to sue if they hadn’t suffered any fraud. But last year an appellate court ruled that customers who had incurred expenses for fraud prevention resulting from the malware attack had secured the needed standing.

That ruling presumably helped spur the $1.6 million settlement announced this June. The four class representatives will each receive $2,500, while customers who can show their credit cards were used at an affected store can receive up to $100 each. Neiman Marcus has also taken voluntary measures to improve its data security including installing chip readers, bringing on a chief information security officer, and educating its workforce.

California courts increasingly following suit

While the matter is not settled law in the Ninth Circuit (which includes California and other West Coast states), in Walters v. Kimpton Hotel & Restaurant Group, the court denied Kimpton’s motion to dismiss along similar grounds as the appellate court in Neiman Marcus. In Walters, the plaintiff alleged that in 2016 he visited a Kimpton hotel and paid with his credit card during a five-month period during which “hackers used malware to access Kimpton computer systems and steal copies of customer data.”

The court found it “plausible” that Walters’s credit card information had been stolen by the hackers. Nevertheless, Kimpton argued the mere theft of credit card data, “coupled with evidence of a single or just a few unauthorized charges, was insufficient” to give Walters standing to sue. Disagreeing with previous rulings in other district courts, Judge Vince Chhabria didn’t buy that argument:

The Court respectfully disagrees that a plaintiff must actually suffer the misuse of his data or an authorized charge before he has an injury for standing purposes. . . . The theft of Walters’s payment card data and the time and effort he has expended to monitor his credit are sufficient to demonstrate injury for standing purposes.

Rulings protect data breach victims

Quoting a similar decision from the Sixth Circuit, Judge Chhabria write that “[t]here is no need for speculation where Plaintiffs allege that their data has already been stolen and is now in the hands of ill-intentioned criminals.” His Kimpton decision, while not binding on other courts, reflects a common-sense understanding of the costs—in money, inconvenience, ruined credit, and stress—that come with being victimized by a data breach.

[QUOTE FROM ERIC GROVER]