On Nov. 19, 2021, the Supreme Court of Appeals of West Virginia lifted the class certification order in a data breach case against West Virginia hospitals due to a lack of standing.^[1]

A lawsuit was filed on behalf of named plaintiffs, Deborah Welch and Eugene Roman, that sought class action status covering the patients whose medical records were impermissibly accessed. The lawsuit stems from a data breach that occurred in 2016 and 2017 when Angela Roberts, a former employee of Berkeley Medical Center and Jefferson Medical Center, hospitals affiliated with the West Virginia University Health System, accessed the medical records of 7,445 patients. The court found that while the employee legitimately accessed the patient records as a part of her job to make appointments, “she simultaneously ‘cased’ those same records to ascertain whether that patient might also be a lucrative target of her identity theft conspiracy.” Of the 7,445 patients whose records were accessed by the employee in her role as a registration specialist, 113 were determined to be victims of identity theft.