14.  Plaintiff and the members of the Class are present and former patients  of CCP.   15.  As a condition for receiving treatment, Plaintiff and Class members  were required by CCP to confide and make available to it, its agents, and its  employees, sensitive and confidential PII, including, but not limited to, their names,  dates of birth, addresses, health insurance information, and other clinical and  treatment information related to the care sought there.   17.  By obtaining, collecting, using, and deriving a benefit from its patients’  PII, CCP assumed legal and equitable duties to those individuals and knew or  should have known that it was responsible for protecting their PII from  unauthorized disclosure.   18.  Plaintiff has taken reasonable steps to maintain the confidentiality of  her PII. Plaintiff, as a current and former patient, relied on CCP to keep her PII  confidential and securely maintained, to use this information for business purposes  only, and to take reasonable steps to ensure that its vendors would make only  authorized disclosures of this information.   19.  Indeed, CCP maintains a policy which specifically acknowledges its  legal obligation to maintain the privacy of patient PII entrusted to it and to control  the disclosure thereof.   20.  CCP’s policy is outlined in its Notice of Privacy Practices (CCP’s  “Privacy Policy”), which was effective on April 14, 2003, and was last revised on  June 1, 2013.6    22.  Plaintiff entrusted her PII to CCP solely for the purpose of effectuating  treatment and the payment therefor with the expectation and implied mutual  understanding that CCP would strictly maintain the confidentiality of the  information and safeguard it from theft or misuse.   23.  Plaintiff would not have entrusted CCP with her highly sensitive PII if  she had known that CCP would entrust it to a vulnerable vendor, such as BST,  thereby failing to protect it from unauthorized use or disclosure.   B.  The security of patients’ PII was compromised in the Data  Breach   24.  Plaintiff has been a patient of CCP for years.    25.  When Plaintiff presented herself to CCP for treatment, its agents  prominently posted and/or provided Plaintiff with various disclosure statements  regarding CCP’s Privacy Policy and its obligations under HIPAA to safeguard  patients’ PII–as CCP was required to do by law.11   27.  Plaintiff reasonably relied upon CCP’s representations to her  detriment and would not have provided her sensitive PII to CCP if not for CCP’s  explicit and implicit promises to adequately safeguard that information.    28.  CCP entrusted the PII that is at issue in this action to BST in order to  use its accounting services.   29.  According to CCP, on or around December 4, 2019, one or more  wrongdoers obtained access to BST’s information technology systems and stole  private and confidential PII, including CCP’s patients’ “name[s], date[s] of birth,  billing codes, insurance description[s] (A definition of the billing / CPT code), and  medical record number[s].”12    30.  According to CCP, “there was an unauthorized intrusion into BST’s  network that contained Community Care Physicians’ data… by an unknown  individual or individuals outside of BST who gained access to part of the network  where certain client files are stored, including files from CCP…” by way of a  ransomware virus.13   32.  Per CCP’s notification, cybercriminals had uninhibited access to  Plaintiff’s and Class Members’ PII for nearly four days.    33.  As a result of this Data Breach, the PII of 170,000 individuals whose  PII was in the possession of BST was compromised.   34.  The Data Breach was preventable and a direct result of BST’s failure  to implement adequate and reasonable cyber-security procedures and protocols  necessary to protect patients’ PII.   35.  The Data Breach was moreover a direct result of CCP entrusting the  Plaintiff’s PII to BST without conducting reasonable inquiry into BST’s data  security practices.   36.  Further, BST allegedly discovered the breach on December 7, 2019, but  Plaintiff and the Class were not notified for months, on or about February 14, 2020.    37.  On or about February 14, 2020, CCP sent letters to the Class members  notifying them that their PII had been compromised during the Data Breach.15   C.  The healthcare industry is a prime target for cybercriminals   39.  Data breaches within the healthcare industry in general, and with  vendors in particular, continued to rapidly increase. According to the 2019  Healthcare Information and Management Systems Society Cybersecurity Survey,  68 percent of participating vendors reported having a significant security incident  within the last 12 months, with a majority of those being caused by “bad actors.”19   41.  The PII stolen in the Data Breach is significantly more valuable than  the loss of, say, credit card information in a large retailer data breach. Victims  affected by those retailer breaches could avoid much of the potential future harm by  simply cancelling credit or debit cards and obtaining replacements. The information  stolen in the Data Breach— most notably name and date of birth —is difficult, if not  impossible, to change.   43.  PII data for sale is so valuable because PII is so broad, and it can  therefore be used for a wide variety of criminal activity such as creating fake IDs,  buying medical equipment and drugs that can be resold on the street, or combining  patient numbers with false provider numbers to file fake claims with insurers.   44.  The value of Plaintiff’s PII on the black market is considerable. Stolen  PII trades on the black market for years, and criminals frequently post stolen  private information openly and directly on various “dark web” internet websites,  making the information publicly available, for a substantial fee of course.    45.  As storehouses of that lucrative information, business associates like  BST are also highly targeted by cybercriminals because they lack “sufficient  resources to prevent or quickly detect a data breach” making them an easier  target.23    47.  Companies can mount two primary defenses to phishing scams:  employee education and technical security barriers.    48.  Employee education is the process of adequately making employees  aware of common phishing attacks and implementing company-wide policies  requiring the request or transfer of sensitive personal or financial information only  through secure sources to known recipients. Employee education and secure file- transfer protocols provide the easiest method to assist employees in properly  identifying fraudulent e-mails and preventing unauthorized access to PII.   50.  HIPAA circumscribes security provisions and data privacy  responsibilities designed to keep patients’ medical information safe. HIPAA  compliance provisions, commonly known as the Administrative Simplification  Rules, establish national standards for electronic transactions and code sets to  maintain the privacy and security of protected health information.27   51.  HIPAA provides specific privacy rules that require comprehensive  administrative, physical, and technical safeguards to ensure the confidentiality,  integrity, and security of PII is properly maintained.28   52.  Moreover, since CCP is a covered entity, and BST is its business  associate, HIPAA requires that CCP, inter alia, obtain satisfactory assurances from  BST that it will appropriately safeguard the PII it receives or creates on behalf of  80.  Plaintiff brings this action on behalf of herself and all others similarly  situated pursuant to Fed. R. Civ. Proc. 23. The Class is preliminarily defined as:   All individuals whose PII was compromised as a result of the Data  Breach with BST & Co. CPAs, LLP which was announced by Community  Care Physicians, P.C. on February 19, 2020.    81.  Excluded from the Class are CCP, BST and their subsidiaries and  affiliates, their officers, directors and member of their immediate families and any  entity in which they have a controlling interest, the legal representatives, heirs,  successors or assigns of any such excluded party, the judicial officer(s) to whom this  action is assigned, and the members of their immediate families.   82.  Plaintiff reserves the right to modify or amend the definition of the  proposed Class and/or to add a subclass(es) if necessary, before this Court  determines whether certification is appropriate.   93.  Plaintiff repeats and incorporates by reference the preceding  paragraphs.   94.   As a condition of receiving health care services, Plaintiff and Class  members were obligated to provide CCP their PII.   95.  Plaintiff and the Class members entrusted their PII to CCP with the  understanding that CCP would safeguard it.   96.  CCP had full knowledge of the sensitivity of the PII and the types of  harm that Plaintiff and Class members could and would suffer if the PII were  wrongfully disclosed.   98.  Further, BST had a duty to exercise reasonable care in safeguarding,  securing, and protecting such information from being compromised, lost, stolen,  misused, and/or disclosed to unauthorized parties. This duty includes, inter alia,  designing, maintaining and testing its security protocols to ensure that Plaintiff’s  and Class members’ PII in its possession was adequately secured and protected and  that employees tasked with maintaining such information were adequately trained  on cyber security measures regarding patient PII.   A. Plaintiff and the Class Members entrusted their PII to CCP   NEGLIGENCE  (On behalf of Plaintiff and the Class against CCP and BST)   