Twelve States File First Multistate Healthcare Data Breach Lawsuit

State Attorneys General from a dozen states filed a lawsuit Monday against several health IT companies, and their subsidiaries, alleging that poor security practices led to theft of protected health information (PHI) of 3.9 million individuals during a data security incident in 2015.

The 66-page complaint, filed in the U.S. District Court for the Northern District of Indiana, names four companies or subsidiaries, including Fort Wayne, Ind.-based Medical Informatics Engineering and NoMoreClipboard LLC. In the lawsuit, the state AGs allege that the companies failed to take “adequate and reasonable measures” to ensure their computer systems were protected.

Over several weeks in May, hackers infiltrated and accessed the “inadequately protected computer systems” of the companies and were able to access and exfiltrate the electronic PHI of 3.9 million individuals, whose PHI was contained in an electronic medical record stores in the companies’ computer systems. The personal information obtained by the hackers included names, addresses and Social Security numbers, as well health information such as lab results, health insurance policy information, diagnosis and medical conditions.

The lawsuit marks the first time state Attorneys General have joined together to pursue a HIPAA-related (Health Insurance Portability and Accountability Act) multistate data breach case in federal court, according to the Arizona Attorney General’s office. The lawsuit was filed by attorneys general from Arizona, Arkansas, Florida, Indiana, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina and Wisconsin.

According to a media report from azcentral.com, Arizonians were among those affected when hackers infiltrated WebChart, a web application operated by Indiana-based Medical Informatics Engineering Inc. and NoMoreClipboard (collectively known as MIE).

The 12 state AGs allege that the companies “failed to take reasonably available steps to prevent the breaches,” and “failed to disclose material facts regarding the inadequacy of their computer systems and security procedures to properly safeguard patients’ PHI, failed to honor their promises and representations that patients’ PHI would be protected, and failed to provide timely and adequate notice of the incident, which caused significant harm to consumers across the U.S,” according to the complaint.

Further, the companies’ actions resulted in the violation of the state consumer protection, data breach, personal information protection laws and federal Health Insurance Portability and Accountability Act (HIPAA) statutes, the lawsuit states.

In July 2015, MIE issued a statement acknowledging the data breach, classifying it as a “data security compromise that has affected the security of some personal and protected health information relating to certain clients and individuals who have used a Medical Informatics Engineering electronic health record.” The company also referred to it as a “sophisticated cyber attack.”

The company said that on May 26, 2015 it discovered suspicious activity in one of its servers. “We immediately began an investigation to identify and remediate any identified security vulnerability. Our first priority was to safeguard the security of personal and protected health information, and we have been working with a team of third-party experts to investigate the attack and enhance data security and protection. This investigation is ongoing. On May 26, 2015, we also reported this incident to law enforcement including the FBI Cyber Squad. Law enforcement is actively investigating this matter, and we are cooperating fully with law enforcement's investigation. The investigation indicates this is a sophisticated cyber attack. Our forensic investigation indicates the unauthorized access to our network began on May 7, 2015. Our monitoring systems helped us detect this unauthorized access, and we were able to shut down the attackers as they attempted to access client data,” the company said in a statement three years ago.

At the time, the company said it was continuing to take steps to remediate and enhance the security of its systems. “Remedial efforts include removing the capabilities used by the intruder to gain unauthorized access to the affected systems, enhancing and strengthening password rules and storage mechanisms, increased active monitoring of the affected systems, and intelligence exchange with law enforcement. We have also instituted a universal password reset,” the company said.

In a statement, Arizona Attorney General Mark Brnovich said the 12 AGs allege MIE is liable because, among other things, “it failed to implement basic industry-accepted data-security measures to protect ePHI from unauthorized access; did not have appropriate security safeguards or controls in place to prevent exploitation of vulnerabilities within its system; had an inadequate and ineffective response to the breach; and failed to encrypt the sensitive personal information and ePHI within its computer systems, despite representations to the contrary in its privacy policy.”

Minnesota Attorney General Lori Swanson said in a news release, “Patients expect health companies to protect the privacy of their electronic health records. This company did not do so.”

The lawsuit says the states are seeking unspecified statutory damages and civil penalties.