Complaint - Class Action Against Deaconess Health System, INC., Medicopy Services, INC., MRO Corp. , Filed by Crystal Fitzgerrel. (Attachments: # 1 Civil Cover Sheet, # 2 Designation Form)(FERICH, Andrew)

Document #1 Filed 03/27/2026 · 59 pages · District Court, E.D. Pennsylvania · View original PDF

INTRODUCTION

1Plaintiff brings this class action lawsuit on behalf of all persons who entrusted Defendants with their sensitive personally identifiable information (“PII”) and personal health information (“PHI”) (collectively, “Private Information”) that was impacted in a data breach that Defendant DHS, a customer of Defendants MRO and MediCopy, publicly disclosed in March 2026 (the “Data Breach” or the “Breach”).

2Plaintiff’s claims arise from Defendants’ failure to properly secure and safeguard Private Information that was entrusted to it, and their accompanying responsibility to store and transfer that information. CRYSTAL FITZGERREL, individually and on behalf of all others similarly situated,

Plaintiff,

MRO CORP., MEDICOPY SERVICES, INC., and DEACONESS HEALTH SYSTEM, INC., Defendants.

3Defendant MRO is a Norristown, Pennsylvania-based entity that provides management, administrative, and operating expertise and services primarily to the healthcare industry. MRO markets itself as “a leading clinical data acquisition and release platform and the KLAS-rated No. 1 provider of release of information (ROI) solutions since 2013,” which “empowers healthcare organizations and consumers of clinical data with proven, enterprise-wide solutions that simplify clinical data extraction, tagging, curation and release challenges.”1

4Defendant MediCopy is a Nashville, Tennessee-based entity that provides also management, administrative, and operating expertise and services primarily to the healthcare industry, serving its “healthcare clients through secure, compliant, and efficient workflows, and providing requesters of health information with exceptional customer service.”2 In early 2022, Defendant MRO acquired Defendant MediCopy,3 and MediCopy now serves as a subsidiary within MRO.

5Defendant DHS is an Evansville, Indiana-based “premiere provider of health care services” which serves “a population of more than 1.5 million in southwestern Indiana, western Kentucky and southeastern Illinois.” DHS “consists of 22 wholly owned, joint ventured, sponsored or affiliated hospital locations situated throughout the Tri-State.”4 DHS contracts with Defendants MRO and MediCopy to handle patients’ release of information requests, which allow health care providers to share sensitive patient information with third parties with a patient’s authorization.5 1 Nicole Hoy, Clinical Data Release Leader MRO Announces Acquisition of MediCopy, MRO (Feb. 22, 2022), https://mrocorp.com/press-release/clinical-data-release-leader-mro-announces- acquisition-of-medicopy/. 2 Who We Are, MEDICOPY, https://medicopy.net/who-we-are (last visited Mar. 26, 2026). 3 Hoy, Clinical Data Release Leader MRO Announces Acquisition of MediCopy, supra note 1. 4 About Us, DEACONESS HEALTH SYSTEMS, https://www.deaconess.com/about-us (last visited Mar. 26, 2026). 5 Houston Harwood, Deaconess Patients’ Sensitive Data Stolen In Vendor Breach, EVANSVILLE COURIER & PRESS (updated Mar. 20, 2026), https://www.courierpress.com/story/news/local/ 2026/03/19/deaconess-health-data-breach-

6Customers or patients of Defendants or Defendants’ customers are required to provide Defendants with, or otherwise authorize Defendants to collect, sensitive Private Information. By being entrusted with this sensitive information, Defendants assumed a legal duty to reasonably safeguard it.

7As reported in March 2026, the Data Breach at issue in this litigation involved unauthorized access to Defendants’ network, with initial unauthorized access detected on January 13, 2026. The breach potentially exposed the PII and PHI of many thousands, if not millions, of individuals.

8According to Defendant DHS, as well as public reports, “an unauthorized actor accessed MRO’s cloud-based file-sharing platform and downloaded an unspecified number of files” on or about January 13, 2026.6 The exposed information is reported to include Social Security numbers, full names, dates of birth, medical record numbers, dates of service, health insurance identification numbers and medical records related to treatment received, and other Private Information, though the exact data compromised varies by individual.7

9The Data Breach was a direct result of Defendants’ failure to implement adequate and reasonable cybersecurity procedures and protocols necessary to protect Private Information from the foreseeable threat of a cyberattack.

10Plaintiff brings this class action lawsuit individually and on behalf of those similarly situated to address Defendants’ inadequate safeguarding of Plaintiff’s and Class Members’ Private Information that Defendants collected and maintained, and for failing to provide adequate notice to Plaintiff and Class Members. exposes-kentucky-patients-ssns-henderson-morganfield-news-hippa-credit/89196026007/. 6 Id. 7 Id.

11Plaintiff brings claims for negligence, breach of fiduciary duty, breach of implied contract, unjust enrichment, and declaratory and injunctive relief. To remedy these violations of law, Plaintiff and Class Members seek actual damages, statutory damages, restitution, and injunctive and declaratory relief (including significant improvements to Defendants’ data security protocols and employee training practices); reasonable attorneys’ fees, costs, and expenses incurred in bringing this action; and all other remedies this Court deems just and proper.

PARTIES

12Plaintiff Crystal Fitzgerrel is a resident citizen of Reed, Kentucky.

13Defendant MRO Corporation is a corporation formed under the laws of the Commonwealth of Pennsylvania, maintaining its principal place of business located at 1000 Madison Avenue, Suite 100, Norristown, Pennsylvania 19403.

14Defendant Deaconess Health Systems, Inc. is a nonprofit corporation formed under the laws of the State of Indiana, maintaining its principal place of business located at 600 Mary St., Evansville, Indiana 47747.

15Defendant MediCopy Services, Inc. is a corporation formed under the laws of the State of Tennessee, maintaining its principal place of business located at 8 City Boulevard, Nashville, Tennessee 37209.

JURISDICTION AND VENUE

16This Court has jurisdiction over this action pursuant to 28 U.S.C. § 1332(d)(2)(A), as modified by the Class Action Fairness Act of 2005, because at least one member of the class is a citizen of a different state than Defendants, there are more than 100 members of the class, and the aggregate amount in controversy exceeds $5,000,000 exclusive of interests and costs.

17This Court has personal jurisdiction over Defendant MRO because Defendant MRO maintains its principal place of business in Pennsylvania and conducts substantial business in Pennsylvania and in this District through its principal place of business; because Defendant MRO engaged in the conduct at issue herein from and within this District; and because Defendant MRO otherwise has substantial contacts with this District and purposely availed itself of the Courts in this District.

18This Court has personal jurisdiction over Defendant MediCopy because Defendant MediCopy conducts substantial business in Pennsylvania and in this District; because Defendant MediCopy engaged in the conduct at issue herein from and within this District; because Defendant MediCopy is a subsidiary of Defendant MRO, which maintains it principal place of business in this District; and because Defendant MediCopy otherwise has substantial contacts with this District and purposely availed itself of the Courts in this District.

19This Court has personal jurisdiction over Defendant DHS because DHS’s patients’ Private Information was acquired, stored, shared, accessed, and compromised in this District; because Defendant DHS contracts with Defendant MRO, which maintains its principal place of business in this District; and because Defendant DHS otherwise has substantial contacts with this District and purposely availed itself of the Courts in this District.

20Venue is proper in this Court pursuant to 28 U.S.C. § 1391(b)(1) because a substantial part of the events giving rise to this action occurred in this District. Moreover, MRO resides in this District, maintains Defendant DHS’s patients’ Private Information, including that of Plaintiff and Class Members, in this District, and this District is where a substantial part of the acts, omissions, and events giving rise to Plaintiff’s claims occurred.

Read the full filing

You’re reading pages 1–5 of 59. Register free to read the complete 59-page transcript on this page.

These are public U.S. federal court records, available free from PACER and the court. Registration unlocks our full on-page transcript — a convenience service.

Public U.S. federal court record (district court docket 73108630, document 1). Source via the RECAP Archive (Free Law Project). The same record is available from PACER. Informational only — not legal advice.