The AGs allege that the company, Medical Informatics Engineering Inc., failed to safeguard the data properly or disclose the incident in a timely fashion, among other charges. (Photo: Shutterstock)
A dozen state attorneys general have united to bring the first multistate lawsuit under federal health care privacy law, in connection with a medical records company data breach that put millions of patient records at risk.
The lawsuit is part of a growing trend of state enforcement of consumer and data privacy laws, and the first such AG suit under HIPAA—the federal Health Insurance Portability and Accountability Act of 1996, which requires companies to protect the privacy of patient information. The U.S. Department of Health and Human Services usually enforces HIPAA and the Federal Trade Commission usually enforces consumer data breach violations.
Related: Google's foray into health records raises privacy concerns
The civil suit was filed Tuesday in the U.S. District Court for the Northern District of Indiana against a Fort Wayne company, Medical Informatics Engineering Inc., over a 2015 data breach during which hackers accessed the personal patient information of more than 3.9 million individuals stored in an electronic medical records database for dozens of institutions. MIE is a third-party provider that licenses a web-based electronic health record program application known as WebChart to health care providers.
The AGs allege that the company failed to safeguard the data properly or disclose the incident in a timely fashion, among other charges. Several other civil suits over the breach, including multidistrict litigation, also are pending in that court. The company acknowledged the breach in security notices in 2015.
The information siphoned from the database included names, addresses, phone numbers, dates of birth, security questions and answers, email addresses, lab results, health insurance policy information, Social Security numbers, doctor's names, diagnoses and other information for more than two weeks before being detected and reported to the FBI, according to the suit.
MIE responded Tuesday to a request for comment in an automated message saying, “We will review your correspondence and the appropriate representative will be contacting you as soon as possible.” The company had not responded further by 1 p.m. Wednesday.
Besides federal HIPAA violations, the AGs' suit alleges various violations of state laws, including data breach notification and deceptive trade practices. The suit seeks injunctive relief as well as an undetermined amount of money for restitution and civil penalties.
Indiana Attorney General Curtis Hill filed the suit on behalf of the 12 states, which also include Arizona, Arkansas, Florida, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina and Wisconsin.
The AGs are both Republicans and Democrats who are part of a trend of attorneys general expanding their litigation and enforcement roles, especially in consumer protection, financial enforcement and health care cases, according to Daniel Suvor, counsel in the Los Angeles office of O'Melveny & Myers. A recent newsletter from the law firm explained.
Complete your profile to continue reading and get FREE access to BenefitsPRO, part of your ALM digital membership.
Your access to unlimited BenefitsPRO content isn’t changing.
Once you are an ALM digital member, you’ll receive:
- Breaking benefits news and analysis, on-site and via our newsletters and custom alerts
- Educational webcasts, white papers, and ebooks from industry thought leaders
- Critical converage of the property casualty insurance and financial advisory markets on our other ALM sites, PropertyCasualty360 and ThinkAdvisor
Already have an account? Sign In Now
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
Sue Reisinger
Senior reporter at ALM since 2004; based in Florida; covers general counsel and white collar crime; contact: [email protected]
