12 State AGs Sue Electronic Medical Records Company Under HIPAA for Data Breach, a First
A dozen state attorneys general have united to bring the first multistate lawsuit under federal health care privacy law, in connection with a medical records company data breach that put millions of patient records at risk. The lawsuit is part of a growing trend of state enforcement of consumer and data privacy laws, and the first such AG suit under HIPAA.
December 05, 2018 at 03:38 PM
3 minute read
The original version of this story was published on Corporate Counsel
A dozen state attorneys general have united to bring the first multistate lawsuit under federal health care privacy law, in connection with a medical records company data breach that put millions of patient records at risk.
The lawsuit is part of a growing trend of state enforcement of consumer and data privacy laws, and the first such AG suit under HIPAA—the federal Health Insurance Portability and Accountability Act of 1996, which requires companies to protect the privacy of patient information. The U.S. Department of Health and Human Services usually enforces HIPAA and the Federal Trade Commission usually enforces consumer data breach violations.
The civil suit was filed Tuesday in the U.S. District Court for the Northern District of Indiana against a Fort Wayne company, Medical Informatics Engineering Inc., over a 2015 data breach during which hackers accessed the personal patient information of more than 3.9 million individuals stored in an electronic medical records database for dozens of institutions. MIE is a third-party provider that licenses a web-based electronic health record program application known as WebChart to health care providers. The AGs allege that the company failed to safeguard the data properly or disclose the incident in a timely fashion, among other charges. Several other civil suits over the breach, including multidistrict litigation, also are pending in that court. The company acknowledged the breach in security notices in 2015.
The information siphoned from the database included names, addresses, phone numbers, dates of birth, security questions and answers, email addresses, lab results, health insurance policy information, Social Security numbers, doctor's names, diagnoses and other information for more than two weeks before being detected and reported to the FBI, according to the suit.
MIE responded Tuesday to a request for comment in an automated message saying, “We will review your correspondence and the appropriate representative will be contacting you as soon as possible.” The company had not responded further by 1 p.m. Wednesday.
Besides federal HIPAA violations, the AGs' suit alleges various violations of state laws, including data breach notification and deceptive trade practices. The suit seeks injunctive relief as well as an undetermined amount of money for restitution and civil penalties.
Indiana Attorney General Curtis Hill filed the suit on behalf of the 12 states, which also include Arizona, Arkansas, Florida, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina and Wisconsin.
The AGs are both Republicans and Democrats who are part of a trend of attorneys general expanding their litigation and enforcement roles, especially in consumer protection, financial enforcement and health care cases, according to Daniel Suvor, counsel in the Los Angeles office of O'Melveny & Myers. A recent newsletter from the law firm explained.
Read more:
State AGs Emerging as 'Most Feared Regulators,' Attorney Says
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllJudge Approves 23andMe's $30M Data Breach Settlement - With Conditions
5 minute readOn Governor's Desk: NY 'Death Gamble' Bill That Seeks to Correct Pension Anomaly for Judges
'Serious Misconduct' From Monsanto Lawyer Prompts Mistrial in Chicago Roundup Case
3 minute readCleary vs. White & Case: NY Showdown Over $5 Billion Brazilian Bankruptcy
Trending Stories
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250