California Risk-Adjustment Firm Sued Over February Data Breach

A company that provides risk adjustment services and solutions for health-care providers was sued for its alleged failure to safeguard personal information that was publicly disclosed in a data breach in February.

The proposed class action filed in the US District Court for the Central District of California accuses Episource LLC of not engaging in the necessary security practices that would have prevented the breach.

Heidi Finke, a patient whose private information was exposed in the breach, filed the suit on behalf of hundreds of other individuals nationwide who had their personal and health information compromised.

The suit alleges the company failed to comply with the Federal Trade Commission guidelines and the Health Insurance Portability and Accountability Act, and seeks damages.

“The ramifications of Defendant’s failure to keep secure the Private information of Plaintiff and Class Members are long lasting and severe,” the suit said.

The complaint filed June 18 alleges the company became aware of suspicious activity on its servers on Feb. 6. An investigation found that patients’ names, addresses, phone numbers, emails, date of birth, and sensitive health records had been breached. Episource began to send out notices to those impacted on June 6.

Other high-profile data breaches at major companies like Microsoft Corp. and Meta Platforms Inc.'s Facebook that affected millions and brought public attention to the importance of online data security suggest that Episource knew or should have known that the information it stored would be targeted, yet it failed to take steps to protect it, the suit said.

Episource didn’t immediately respond to requests for comment.

Finke is represented by Ahdoot and Wolfson PC.

The case is Finke v. Episource, LLC, C.D. Cal., No. 2:25-cv-05552, complaint filed 6/18/25.