Delayed notification of Mt. Baker Imaging data breach leads to lawsuit
Mt. Baker Imaging and Northwest Radiologists have sent out letters notifying patients of a data breach about 10 months after the breach occurred. Over 348,000 Washingtonians were affected, according to the Office of the Attorney General.
The letters state that information stored in the company’s network was “subject to unauthorized access” from Jan. 20-25. This is the first time that patients were officially notified of the breach.
Information that may have been affected included patients’ first and last names as well as any combination of an associated address, phone number, social security number, date of birth, email address, driver’s license number, treatment or diagnosis information, provider name, medical record or patient identification number, health insurance number and/or treatment cost information.
In an online notification posted Oct. 30, Mt. Baker Imaging said it “immediately worked to obtain up-to-date address information in order to provide impacted individuals with notification of this event.”
The breach was reported to the Office of the Attorney General on July 10. The office said it is “not at liberty to speculate on why the company took the amount of time it did to send our office notice.”
A spokesperson added that under state statute, notice may be delayed at the request of law enforcement or if needed to determine the scope of the breach. He said that Northwest Radiologists/Mt. Baker Imaging “has not indicated” the reason for the delay.
A class action lawsuit was filed in Whatcom County Superior Court on April 25 in response to the data breach. In the complaint, a Ferndale man and a Bellingham man alleged that Northwest Radiologists/Mt. Baker Imaging delayed informing members of the breach, “causing them to suffer ascertainable losses in the form of the loss of the benefit of their bargain and the value of their time reasonably incurred to remedy or mitigate the effects of the attack.”
The lawsuit also alleges that Northwest Radiologists/Mt. Baker Imaging hasn’t implemented cybersecurity measures to prevent future breaches, leaving “significant vulnerabilities” in its system. It states that Northwest Radiologists/Mt. Baker Imaging should have known to improve its security even before the breach because of the “substantial increase” in cyberattacks in the healthcare industry.
The plaintiffs allege that Northwest Radiologists/Mt. Baker Imaging failed to follow Federal Trade Commission guidelines to protect against unauthorized access to sensitive information, which also led the company to violate HIPAA.
The lawsuit accuses Northwest Radiologists/Mt. Baker Imaging of negligence, breach of implied contract, unjust enrichment, invasion of privacy and violation of the Washington Consumer Protection Act, Washington Data Breach Notification Disclosure Law, Uniform Health Care Information Act and Washington My Health My Data Act.
The plaintiffs are asking for the court to instruct Northwest Radiologists/Mt. Baker Imaging to stop “future deceptive practices” and provide restitution “in an amount to be determined at trial.”
Mt. Baker Imaging and Northwest Radiologists were served legal summons on May 15. Neither have responded, according to available court records.
Northwest Radiologists/Mt. Baker Imaging did not respond to request for comment.
Anyone with questions or concerns about the data breach can contact a dedicated assistance line at 855-291-2706 between noon and midnight on weekdays excluding holidays.
This story was originally published November 12, 2025 at 10:28 AM with the headline "Delayed notification of Mt. Baker Imaging data breach leads to lawsuit."