12 State AGs Sue Medical Records Company Under HIPAA for Data Breach, a First
A dozen state attorneys general have united to bring the first multistate lawsuit under federal health care privacy law, in connection with a medical records company data breach that put millions of patient records at risk. The lawsuit is part of a growing trend of state enforcement of consumer and data privacy laws, and the first such AG suit under HIPAA.
December 05, 2018 at 03:38 PM
3 minute read
The original version of this story was published on Corporate Counsel
A dozen state attorneys general have united to bring the first multistate lawsuit under federal health care privacy law, in connection with a medical records company data breach that put millions of patient records at risk.
The lawsuit is part of a growing trend of state enforcement of consumer and data privacy laws, and the first such AG suit under HIPAA—the federal Health Insurance Portability and Accountability Act of 1996, which requires companies to protect the privacy of patient information. The U.S. Department of Health and Human Services usually enforces HIPAA and the Federal Trade Commission usually enforces consumer data breach violations.
The civil suit was filed Tuesday in the U.S. District Court for the Northern District of Indiana against a Fort Wayne company, Medical Informatics Engineering Inc., over a 2015 data breach during which hackers accessed the personal patient information of more than 3.9 million individuals stored in an electronic medical records database for dozens of institutions. MIE is a third-party provider that licenses a web-based electronic health record program application known as WebChart to health care providers. The AGs allege that the company failed to safeguard the data properly or disclose the incident in a timely fashion, among other charges. Several other civil suits over the breach, including multidistrict litigation, also are pending in that court. The company acknowledged the breach in security notices in 2015.
The information siphoned from the database included names, addresses, phone numbers, dates of birth, security questions and answers, email addresses, lab results, health insurance policy information, Social Security numbers, doctor's names, diagnoses and other information for more than two weeks before being detected and reported to the FBI, according to the suit.
MIE responded Tuesday to a request for comment in an automated message saying, “We will review your correspondence and the appropriate representative will be contacting you as soon as possible.” The company had not responded further by 1 p.m. Wednesday.
Besides federal HIPAA violations, the AGs' suit alleges various violations of state laws, including data breach notification and deceptive trade practices. The suit seeks injunctive relief as well as an undetermined amount of money for restitution and civil penalties.
Indiana Attorney General Curtis Hill filed the suit on behalf of the 12 states, which also include Arizona, Arkansas, Florida, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina and Wisconsin.
The AGs are both Republicans and Democrats who are part of a trend of attorneys general expanding their litigation and enforcement roles, especially in consumer protection, financial enforcement and health care cases, according to Daniel Suvor, counsel in the Los Angeles office of O'Melveny & Myers. A recent newsletter from the law firm explained.
Read more:
State AGs Emerging as 'Most Feared Regulators,' Attorney Says
This content has been archived. It is available through our partners, LexisNexis® and Bloomberg Law.
To view this content, please continue to their sites.
Not a Lexis Subscriber?
Subscribe Now
Not a Bloomberg Law Subscriber?
Subscribe Now
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTravis Lenkner Returns to Burford Capital With an Eye on Future Growth Opportunities
Legal Speak's 'Sidebar With Saul' Part V: Strange Days of Trump Trial Culminate in Historic Verdict
1 minute readLegal Speak's 'Sidebar with Saul' Part IV: Deliberations Begin in First Trump Criminal Trial
1 minute readJosh Partington of Snell & Wilmer Is in Fact a Rock Star in the Office (and Out of It)
1 minute readTrending Stories
- 1The Law Firm Disrupted: Playing the Talent Game to Win
- 2GlaxoSmithKline Settles Most Zantac Lawsuits for $2.2B
- 3BD Settles Thousands of Bard Hernia Mesh Lawsuits
- 4Preparing Your Law Firm for 2025: Smart Ways to Embrace AI & Other Technologies
- 5Inside Track: Late-Career In-House Leaders Offer Words to Live by
Who Got The Work
Eleanor M. Lackman of Mitchell Silberberg & Knupp has entered an appearance for Canon, the Japanese camera maker, and the Brooklyn Nets in a pending trademark infringement lawsuit. The case, filed Sept. 16 in California Central District Court by T-Rex Law on behalf of technology company Phinge Corporation, pursues claims against the defendants for their ongoing use of the 'Netaverse' mark. The suit contends that the defendants' use of the mark in connection with a virtual reality platform will likely create consumer confusion. The case, assigned to U.S. District Judge Consuelo B. Marshall, is 2:24-cv-07917, Phinge Corporation v. Yankees Entertainment and Sports Network, LLC et al.
Who Got The Work
Fox Rothschild partner Glenn S. Grindlinger has entered an appearance for Garage Management Company in a pending lawsuit over alleged wage-and-hour violations. The case was filed Aug. 31 in New York Southern District Court by the Abdul Hassan Law Group on behalf of a manual worker who contends that he was not properly compensated for overtime hours worked. The case, assigned to U.S. District Judge Analisa Torres, is 1:24-cv-06610, Bailey v. Garage Management Company LLC.
Who Got The Work
Veronica M. Keithley of Stoel Rives has entered an appearance for Husky Terminal and Stevedoring LLC in a pending environmental lawsuit. The suit, filed Aug. 12 in Washington Western District Court by Kampmeier & Knutsen on behalf of Communities for a Healthy Bay, seeks to declare that the defendant has violated the Clean Water Act by releasing stormwater discharges on Puget Sound and Commencement Bay. The case, assigned to U.S. District Judge Benjamin H. Settle, is 3:24-cv-05662, Communities for a Healthy Bay v. Husky Terminal and Stevedoring LLC.
Who Got The Work
Caroline Pignatelli of Cooley has entered an appearance for law firm Cooley, partner Matt Hallinan, retired partner Michael Tu and a pair of Cooley associates in a pending fraud lawsuit related to the firm's representation of startup company Carbon IQ and founder Benjamin Cantey. The case, filed Sept. 26 in New Jersey District Court by the DalCortivo Law Offices on behalf of Gould Ventures and member Jason Gould, contends that the defendants deliberately or recklessly concealed critical information from the plaintiffs regarding fraud allegations against Cantey. Gould claims that he would not have accepted a position on Carbon IQ's board of directors or made a 2022 investment in the company if the fraud allegations had been disclosed. The case, assigned to U.S. District Judge Robert Kirsch, is 3:24-cv-09485, Gould Ventures, LLC et al v. Cooley, LLP et al.
Who Got The Work
Attorneys from Skadden, Arps, Slate, Meagher & Flom have stepped in to represent PDD Holdings, the operator of online marketplaces Pinduoduo and Temu, in a pending securities class action. The case, filed Sept. 30 in New York Eastern District Court by Labaton Keller Sucharow and VanOverbeke, Michaud & Timmony, contends that the defendants concealed information that rendered the growth of PDD unsustainable and posed substantial risks to PDD’s business, including merchant policies that made it unprofitable for vendors to do business on PDD platforms; malware issues on PDD applications; and PDD’s failure to implement effective compliance systems. The case, assigned to U.S. District Judge Pamela K. Chen, is 1:24-cv-06881, Macomb County Retiree Health Care Fund v. Pdd Holdings Inc. et al.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250