KU Health physical therapist accessed women’s plastic surgery files, lawsuit says

A University of Kansas Health physical therapist is accused of unlawfully accessing the medical records, including nude clinical photos and body measurements, of over 400 women, a class action lawsuit filed in U.S. District Court in Kansas alleges.

The lawsuit, which lists two Jane Does as plaintiffs filing on behalf of hundreds of other victims, was filed against KU Health, Lawrence Memorial Hospital, an affiliate of KU Health where the victims underwent procedures, and Epic Systems Corporation, which hosted the electronic records.

The physical therapist allegedly began unlawfully accessing medical records in February 2021, according to the lawsuit. The therapist allegedly targeted women who had breast augmentation and related surgical procedures at Plastic Surgery Specialists of Lawrence, a clinic inside Lawrence Memorial.

The lawsuit alleges at least 425 patients had their records illegally accessed.

The victims claim they had no treatment relationship with the therapist and did not receive medical treatment from KU Health related to their procedures at Lawrence Memorial.

One of the Jane Does has been a patient of KU Health, and some of her clinical photos included her face.

In statements, both KU Health and Lawrence Memorial said they are aware of the lawsuit.

“The University of Kansas Hospital is one of three parties named in a lawsuit alleging violations of patient privacy,” a KU Health System spokesperson said. “We take this seriously; patient privacy is very important to us. We just received the complaint, and our teams are reviewing it currently.”

In a letter sent Thursday to community stakeholders, Lawrence Memorial president and CEO Russ Johnson disputed the claim that the employee at the center of the lawsuit was a physical therapist.

The hospital immediately shut down the employee’s access and launched an investigation when it found an outlier in its system, the letter said. According to Lawrence Memorial, their investigation showed most records were accessed appropriately and related to the employee’s job duties, and there was no breach of records for the two Jane Does, the letter said.

Hospital officials would not elaborate on how they made those determinations to The Star.

Epic Systems Corporation did not respond to a request for comment.

The lawsuit argues KU Health knew that patient records were improperly accessed, citing KU Health’s reporting of 31 incidents of unauthorized access, improper disposal, loss, and theft of patient records from Feb. 2021 to Feb. 2024.

KU Health found out about the privacy invasions in Feb. 2023, the lawsuit alleges. The next month, the health system sent victims a letter stating their records were compromised in a data breach by an employee between Feb. 2021 and Feb. 2023.

The letter said the health system investigated immediately and confirmed the employee accessed patient records outside their job duties.

The letter did not reveal the employee’s identity, but said the employee was terminated. KU Health also claimed “[t]he employee’s access to your information was not continuous or ongoing.”

Limited help from hospitals

One of the Jane Does was informed by her Lawrence Memorial surgeon that the physical therapist keystroked her name, letter-by-letter, multiple times to access her records, even though she received no treatment from KU Health, the lawsuit said.

The surgeon wouldn’t disclose if the physical therapist accessed her pictures and measurements, but said her clinical files containing the items were “sistered in” to KU Health’s system.

The first Jane Doe arranged an in-person meeting with KU Health, where officials showed her a packet on how the therapist accessed her records by keystroke. The therapist took at least one screenshot of the first Jane Doe’s driver’s license and also had her records stretching back to at least 2010.

Officials told her the therapist was able to access the records through a “continuation of care” portal between KU Health and Lawrence Memorial.

KU Health refused to give her a copy of the packet and the first Jane Doe did not receive additional support after the meeting, the lawsuit said.

The second Jane Doe received KU Health’s letter and has received treatment at KU Health facilities for other matters.

Lawrence Memorial and KU Health hospital didn’t share any details about the data breach with her beyond the letter.

The plaintiffs are demanding a jury trial, and requesting the trial be conducted in Kansas City, Kansas.

This story was originally published April 17, 2025 at 10:17 AM.