Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Breach topic
No spam. Unsubscribe anytime.
Judge holds off on data-breach trial against Cumberland County Hospital, orders limited discovery
Summary
At a May hearing, the judge found the hospital's sovereign-immunity defense dispositive for now and ordered narrow discovery about insurance and governance; plaintiffs say a ransomware incident exposed names, DOBs and Social Security numbers and seek damages and mitigation costs.
A Cumberland County Circuit Court judge on May 12 paused much of a consolidated data-breach lawsuit against Cumberland County Hospital and directed limited discovery focused on whether sovereign immunity applies and whether the hospital purchased insurance that would waive that immunity.
The ruling came during oral argument on motions to dismiss, in which plaintiffs' counsel Laura Vanote said the hospital's breach exposed a package of personally identifying information — full names, dates of birth and Social Security numbers — creating a substantial, imminent risk of identity theft and other harms that already required mitigation steps such as credit monitoring.
"There's a substantial and present risk of fraud, identity theft and injury," Vanote said, arguing that mitigation costs, the loss of privacy and emotional distress are cognizable injuries even if fraud has not yet occurred.
Hospital counsel responded that Cumberland County's hospital is a county instrumentality entitled to governmental immunity unless the state legislature has waived that immunity; counsel told the court that no insurance policy had been identified that would produce a statutory waiver under Kentucky law.
The judge said the immunity question is a threshold issue that could end the litigation and therefore decided to resolve the immunity question after a short, targeted discovery period rather than allow full-blown fact and expert proceedings immediately. "I'm just going to rule today that Cumberland County Hospital does have immunity if that's appealable," the judge said, but then instructed the parties to agree to a scope of limited discovery to place a factual record before any final, appealable order.
Specifically the court directed the parties to confer and propose a narrow discovery plan to the court. Among items the judge identified as foundational were (1) evidence establishing whether the hospital was created by the county fiscal court, (2) the hospital's insurance program and any policies that might produce a statutory waiver, and (3) limited foundational testimony from the hospital's leadership about governance/insurance decisions. The judge said he would hold the immunity ruling but allow it to be appealed once the record is made.
Defense counsel acknowledged documents previously submitted with the motion to dismiss but plaintiffs' counsel said those papers were one-sided and that minimal discovery — including a short deposition of a hospital official and targeted insurance documents — was necessary. The judge set a schedule for the parties to exchange a proposed scope and asked that proposed discovery be filed in the record so the court could supervise a brisk, limited process before further briefing.
The hearing did not resolve merits questions about negligence, cyber hygiene, or damages; rather it limited the immediate issue of whether the complaint may proceed at all. The court left other defenses and factual issues for later proceedings depending on the outcome of the limited discovery and any interlocutory appeal.
What's next: The court instructed the parties to confer on a proposed limited-discovery plan and to file it for the judge's approval. Pending that process, the immunity question will be treated as the primary, threshold issue for this matter.
