12 State AGs Sue Electronic Medical Records Company Under HIPAA for Data Breach, a First
A dozen state attorneys general have united to bring the first multistate lawsuit under federal health care privacy law, in connection with a medical records company data breach that put millions of patient records at risk. The lawsuit is part of a growing trend of state enforcement of consumer and data privacy laws, and the first such AG suit under HIPAA.
December 05, 2018 at 03:38 PM
3 minute read
Photo: Shutterstock
A dozen state attorneys general have united to bring the first multistate lawsuit under federal health care privacy law, in connection with a medical records company data breach that put millions of patient records at risk.
The lawsuit is part of a growing trend of state enforcement of consumer and data privacy laws, and the first such AG suit under HIPAA—the federal Health Insurance Portability and Accountability Act of 1996, which requires companies to protect the privacy of patient information. The U.S. Department of Health and Human Services usually enforces HIPAA and the Federal Trade Commission usually enforces consumer data breach violations.
The civil suit was filed Tuesday in the U.S. District Court for the Northern District of Indiana against a Fort Wayne company, Medical Informatics Engineering Inc., over a 2015 data breach during which hackers accessed the personal patient information of more than 3.9 million individuals stored in an electronic medical records database for dozens of institutions. MIE is a third-party provider that licenses a web-based electronic health record program application known as WebChart to health care providers. The AGs allege that the company failed to safeguard the data properly or disclose the incident in a timely fashion, among other charges. Several other civil suits over the breach, including multidistrict litigation, also are pending in that court. The company acknowledged the breach in security notices in 2015.
The information siphoned from the database included names, addresses, phone numbers, dates of birth, security questions and answers, email addresses, lab results, health insurance policy information, Social Security numbers, doctor's names, diagnoses and other information for more than two weeks before being detected and reported to the FBI, according to the suit.
MIE responded Tuesday to a request for comment in an automated message saying, “We will review your correspondence and the appropriate representative will be contacting you as soon as possible.” The company had not responded further by 1 p.m. Wednesday.
Besides federal HIPAA violations, the AGs' suit alleges various violations of state laws, including data breach notification and deceptive trade practices. The suit seeks injunctive relief as well as an undetermined amount of money for restitution and civil penalties.
Indiana Attorney General Curtis Hill filed the suit on behalf of the 12 states, which also include Arizona, Arkansas, Florida, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina and Wisconsin.
The AGs are both Republicans and Democrats who are part of a trend of attorneys general expanding their litigation and enforcement roles, especially in consumer protection, financial enforcement and health care cases, according to Daniel Suvor, counsel in the Los Angeles office of O'Melveny & Myers. A recent newsletter from the law firm explained.
Read more:
State AGs Emerging as 'Most Feared Regulators,' Attorney Says
Legislating Cybersecurity: 2018 Adds Patches to the Quilt of Data Privacy Law Across the US
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View All
Netflix Music Guru Becomes First GC of Startup Helping Independent Artists Monetize Catalogs
2 minute read
Global Software Firm Trying to Jump-Start Growth Hands CLO Post to 3-Time Legal Chief
Supreme Court Reinstates Corporate Disclosure Law Pending Challenge
Trending Stories
- 1No Two Wildfires Alike: Lawyers Take Different Legal Strategies in California
- 2Poop-Themed Dog Toy OK as Parody, but Still Tarnished Jack Daniel’s Brand, Court Says
- 3Meet the New President of NY's Association of Trial Court Jurists
- 4Lawyers' Phones Are Ringing: What Should Employers Do If ICE Raids Their Business?
- 5Freshfields Hires Ex-SEC Corporate Finance Director in Silicon Valley
Who Got The Work
J. Brugh Lower of Gibbons has entered an appearance for industrial equipment supplier Devco Corporation in a pending trademark infringement lawsuit. The suit, accusing the defendant of selling knock-off Graco products, was filed Dec. 18 in New Jersey District Court by Rivkin Radler on behalf of Graco Inc. and Graco Minnesota. The case, assigned to U.S. District Judge Zahid N. Quraishi, is 3:24-cv-11294, Graco Inc. et al v. Devco Corporation.
Who Got The Work
Rebecca Maller-Stein and Kent A. Yalowitz of Arnold & Porter Kaye Scholer have entered their appearances for Hanaco Venture Capital and its executives, Lior Prosor and David Frankel, in a pending securities lawsuit. The action, filed on Dec. 24 in New York Southern District Court by Zell, Aron & Co. on behalf of Goldeneye Advisors, accuses the defendants of negligently and fraudulently managing the plaintiff's $1 million investment. The case, assigned to U.S. District Judge Vernon S. Broderick, is 1:24-cv-09918, Goldeneye Advisors, LLC v. Hanaco Venture Capital, Ltd. et al.
Who Got The Work
Attorneys from A&O Shearman has stepped in as defense counsel for Toronto-Dominion Bank and other defendants in a pending securities class action. The suit, filed Dec. 11 in New York Southern District Court by Bleichmar Fonti & Auld, accuses the defendants of concealing the bank's 'pervasive' deficiencies in regards to its compliance with the Bank Secrecy Act and the quality of its anti-money laundering controls. The case, assigned to U.S. District Judge Arun Subramanian, is 1:24-cv-09445, Gonzalez v. The Toronto-Dominion Bank et al.
Who Got The Work
Crown Castle International, a Pennsylvania company providing shared communications infrastructure, has turned to Luke D. Wolf of Gordon Rees Scully Mansukhani to fend off a pending breach-of-contract lawsuit. The court action, filed Nov. 25 in Michigan Eastern District Court by Hooper Hathaway PC on behalf of The Town Residences LLC, accuses Crown Castle of failing to transfer approximately $30,000 in utility payments from T-Mobile in breach of a roof-top lease and assignment agreement. The case, assigned to U.S. District Judge Susan K. Declercq, is 2:24-cv-13131, The Town Residences LLC v. T-Mobile US, Inc. et al.
Who Got The Work
Wilfred P. Coronato and Daniel M. Schwartz of McCarter & English have stepped in as defense counsel to Electrolux Home Products Inc. in a pending product liability lawsuit. The court action, filed Nov. 26 in New York Eastern District Court by Poulos Lopiccolo PC and Nagel Rice LLP on behalf of David Stern, alleges that the defendant's refrigerators’ drawers and shelving repeatedly break and fall apart within months after purchase. The case, assigned to U.S. District Judge Joan M. Azrack, is 2:24-cv-08204, Stern v. Electrolux Home Products, Inc.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250
