photo by: Contributed

LMH Health's main campus at 325 Maine St.

A class action complaint has been filed against the University of Kansas Health System and LMH Health by patients alleging that their personal information, including nude medical photos, was improperly accessed by a physical therapist who had no connection to the patients’ cases.

The complaint, filed Tuesday in the U.S. District Court for Kansas by Stueve Siegel Hanson LLP, demands more than $5 million on behalf of at least 425 patients who had undergone various surgeries and procedures at Plastic Surgery Specialists of Lawrence, an affiliate of LMH. Patients say they suffered “grave invasions of privacy” when their most intimate medical files were accessed by the physical therapist who had no affiliation to LMH or the plastic surgery clinic.

The therapist used his KU Health credentials for two years, the complaint alleges, to access the patient records, including nude photos, body measurements and other sensitive details, through an electronic records portal.

KU Health terminated the employee but failed to notify law enforcement, the complaint alleges; instead, KU Health notified patients of patient-file breaches by an employee but without disclosing the exact nature and scope of what had occurred. LMH, the complaint says, did not provide any notice at all about the breach.

Wisconsin-based Epic Systems Corporation, who provides the electronic health records portal software, has also been named as a defendant.

The two named plaintiffs in the complaint are Jane Doe No. 1 and Jane Doe No. 2, both of whom were patients at one time of KU Health and of the Lawrence plastic surgery clinic.

The physical therapist, who is unknown to the women, is said to have specifically targeted the files of female patients who had undergone breast augmentation procedures in Lawrence. The privacy breaches are alleged to have occurred between “at least” February 2021 and Feb. 22, 2023, when KU Health was alerted to or detected them.

The privacy invasions have caused “profound emotional and psychological trauma” to plaintiffs, including persistent anxiety when seeking medical treatment and a loss of trust in confidentiality. Additionally plaintiffs claim a “debilitating fear” that they are being stalked by the therapist, who they have reason to believe lives in Lawrence.

The complaint alleges 13 legal violations, including computer fraud and abuse, negligence, breach of contract, invasion of privacy, intentional infliction of emotional distress and other claims. It asks the court to certify the matter as a class action and to set it for jury trial.

The Journal-World has reached out to LMH Health and KU Health for comment.