A dozen state attorneys general have united to bring the first multistate lawsuit under  federal health care privacy law, in connection with a medical records company data breach that put millions of patient records at risk.

The lawsuit is part of a growing trend of state enforcement of consumer and data privacy laws, and the first such AG suit under HIPAA—the federal Health Insurance Portability and Accountability Act of 1996, which requires companies to protect the privacy of patient information. The U.S. Department of Health and Human Services usually enforces HIPAA and the Federal Trade Commission usually enforces consumer data breach violations.

The civil suit was filed Tuesday in the U.S. District Court for the Northern District of Indiana against a Fort Wayne company, Medical Informatics Engineering Inc., over a 2015 data breach during which hackers accessed the personal patient information of more than 3.9 million individuals stored in an electronic medical records database for dozens of institutions. MIE is a third-party provider that licenses a web-based electronic health record program application known as WebChart to health care providers. The AGs allege that the company failed to safeguard the data properly or disclose the incident in a timely fashion, among other charges. Several other civil suits over the breach, including multidistrict litigation, also are pending in that court. The company acknowledged the breach in security notices in 2015.