A dozen state attorneys general have joined together to file the first multistate HIPAA-related data breach case in federal court. Amidst a growing trend of stronger enforcement of data privacy laws, this is the first such state attorney general case under federal health care privacy law.
Attorneys general (“AGs”) from 12 states announced Wednesday, December 5th, that they have filed a complaint against Medical Informatics Engineering, Inc. and NoMoreClipboard, LLC (collectively “MIE”), a web-based electronic health record company based in Fort Wayne, Indiana. The action is the first state AG suit under HIPAA.
The complaint alleges that, due to MIE’s violation of HIPAA, millions of patient records were put at risk. According to the AGs, in May 2015, hackers infiltrated a web application run by MIE, which stores patient information for dozens of institutions; as a result, the hackers allegedly stole the electronic Protected Health Information (“ePHI”) of more than 3.9 million individuals, including names, telephone numbers, mailing addresses, usernames, hashed passwords, security questions and answers, spousal information (name and potentially date of birth), email addresses, dates of birth, Social Security numbers, and other information. According to the complaint, the hackers had access to this information for more than two weeks before the breach was detected and reported to the FBI.
The AGs have alleged that MIE failed to institute proper data security safeguards to protect ePHI from unauthorized access. Moreover, the AGs argue that the company did not have appropriate controls in place to prevent the exploitation of its system’s vulnerabilities, and when the breach occurred, the company failed to disclose it in a timely fashion.
Other than federal HIPAA violations, the AGs’ suit alleges numerous violations of state laws, including data breach notification and deceptive trade practices. The complaint requests injunctive relief as well as an undetermined amount of money for restitution and civil penalties.
Indiana Attorney General Curtis Hill filed the suit on behalf of the 12 states, which also include Arizona, Arkansas, Florida, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina and Wisconsin.
