Planned Parenthood Montana

Affiliate: Planned Parenthood of Montana
also called Intermountain Planned Parenthood.

Montana doesn’t do state inspections of this type of facility.

Planned Parenthood locations: 5. Covered here: 5

Patients who feel a need to file a complaint:
Montana Quality Assurance Division – Complaints and Reporting

Entire State

Baldwin Park Planned Parenthood

2024 Data Breach: Two Lawsuits

Downey

Court Document:

MT Downey 2025 Class Action Complaint

Excerpt:

6. The impact to its systems strongly implies that Defendant lacked sufficient cybersecurity incident response and disaster recovery plans . . . as is the industry norm.

7. Notwithstanding that the attack occurred at least by August 24, 2024, Defendant waited until November 5, 2024, to begin notifying its current and former patients of the Data Breach.

8. Defendant’s unreasonable and unexplained delays prevented Plaintiff from being able to timely protect herself from the significantly increased risk of harm . . .

78. Because of the Data Breach, Plaintiff Downey anticipates spending considerable time and money on an ongoing basis to try to mitigate and address harms caused by the Data Breach . . . Plaintiff is at present risk and will continue to be at increased risk of identity theft and fraud for years to come.

Sullivan

Court Document:

MT Sullivan 2024 Class Action Complaint

Excerpt:

2. The Private Information compromised in the Data Breach included certain personal or protected health information . . . including Plaintiff’s minor child . . .

3. The Private Information was exposed to cybercriminals who perpetrated the attack and remains in the hands of those cybercriminals. According to Defendant’s report to the U.S. Department of Health and Human Services, 18,003 individuals’ sensitive data was compromised . . .

32. The U.S. Department of Health and Human Services requires, “[i]f a breach of unsecured protected health information affects 500 or more individuals, a covered entity must notify the Secretary of the breach without unreasonable delay in in no case later that 60 calendar days from the discovery of the breach.” . . .

34. Defendant’s notice to HHS was dated November 5, 2024 – around ten weeks after the incident was discovered.

35. Defendant had obligations created by HIPPA, contract, industry standards, state statutes, common law, and representations made to Class Members, to keep Class Members’ Private Information confidential and to protect it from unauthorized access and disclosure.