Arkansas Attorney General Leslie Rutledge today announced a lawsuit against Eastern Ozarks Regional Health System for failing to protect sensitive patient information, both personal and medical, after the hospital closed. The suit alleges that the former Cherokee Village hospital violated the Personal Information Protection Act (PIPA) and the Arkansas Deceptive Trade Practices Act (ADTPA) when the hospital abruptly closed its doors, locking out employees and abandoning patient and employee files. Because the hospital and its clinics operated for about 9 years, the Attorney General estimates that there could be several thousands of files that were left behind in the unsecured buildings. These files contained social security numbers, driver’s license numbers, account information, medical information and biometric data.
“Consumers must be able to trust their healthcare providers and employers to protect their personal information,” said Attorney General Leslie Rutledge. “Eastern Ozarks Regional Health System betrayed that trust and left patients and employees vulnerable to scams and identity theft. I am holding the hospital and its owners accountable.”
Eastern Ozarks Regional Health System closed in December 2004. In 2010, the property transferred to the State of Arkansas due to the owners’ failure to pay taxes. In 2021, the Attorney General’s Office conducted a site visit of the property and confirmed that possible PIPA and ADTPA violations existed. The facility had been vandalized and was in serious disrepair. Many files throughout the property appeared to have been examined, likely by trespassers seeking to steal significant personal information. The total number of files has not yet been determined; however, investigators with the Attorney General’s Office estimate that there are thousands of files throughout the facility and storage buildings. The suit alleges that Eastern Ozarks Regional Health System failed to provide proper disposal or proper security for the documents prior to the properties being conveyed to the State of Arkansas. The hospital and its owners face civil penalties up to $10,000 for each violation of the PIPA and the ADTPA.
