The University of Kansas Health System and Epic Systems Corp. negligently failed to prevent a physical therapist from accessing nude clinical photographs and other sensitive data of at least 425 female plastic-surgery patients at an outside hospital, a proposed federal class action said.