State Attorneys General Secure Settlement in First-Ever Multistate HIPAA Data Breach Lawsuit | Practical Law

State Attorneys General Secure Settlement in First-Ever Multistate HIPAA Data Breach Lawsuit | Practical Law

An Indiana-based internet electronic health records company and several state attorneys general have reached a $900,000 settlement in litigation involving a data breach of the protected health information (PHI) of 3.9 million individuals. The company, a business associate (BA) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), recently entered into a resolution agreement with the Department of Health and Human Services (HHS) to settle potential HIPAA violations resulting from the same incident.

State Attorneys General Secure Settlement in First-Ever Multistate HIPAA Data Breach Lawsuit

by Practical Law Employee Benefits & Executive Compensation
Published on 10 Jun 2019 • USA (National/Federal)
An Indiana-based internet electronic health records company and several state attorneys general have reached a $900,000 settlement in litigation involving a data breach of the protected health information (PHI) of 3.9 million individuals. The company, a business associate (BA) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), recently entered into a resolution agreement with the Department of Health and Human Services (HHS) to settle potential HIPAA violations resulting from the same incident.
A federal district court has approved a consent judgment and order in litigation between several state attorneys general and a web-based electronic health records company involving a data breach of the protected health information (PHI) of 3.9 million individuals (State of Indiana v. Med. Informatics Eng'g, Inc., 3:18-cv-969 (N.D. Ind. May 23, 2019)). The judgment in this litigation requires the company to:
  • Pay the plaintiff-states $900,000 (collectively), in three installments, due over the course of three years.
  • Take steps to protect the electronic PHI (ePHI) in its possession.
The company, a HIPAA business associate (BA) and third-party service provider, furnishes electronic medical record services to HIPAA covered entities (CEs). The company recently entered into a resolution agreement with the Department of Health and Human Services (HHS) to settle potential violations of HIPAA's Privacy Rule and Security Rule resulting from the same incident. Under the HHS settlement agreement, the company was required to pay HHS $100,000 and comply with a two-year corrective action plan (CAP) (see Legal Update, HHS Addresses HIPAA Business Associate Compliance in Direct Liability Guidance: BA's Failure to Assess Risks to ePHI Leads to $100,000 HIPAA Settlement and Practice Note, HIPAA Enforcement: Settlement Agreements).

Unauthorized Access to Servers Resulted in Impermissible Disclosure

In May 2015, the company discovered suspicious activity on one of its servers. Using compromised login information, hackers had gained access to the personal information of 3.9 million individuals, including the individuals' names, addresses, birth dates, Social Security numbers, email addresses, and hashed passwords. The hackers also obtained the individuals' medical information – including lab results, health insurance policy information, doctors' names, medical conditions, and disability codes. The attorneys general for 16 states sued the company for violations of HIPAA and state deceptive trade practices, personal information protection acts (PIPAs), and breach notification laws.

Consent Judgment and Order Requires HIPAA Compliance

The court's order requires the company to comply with all of HIPAA's administrative and technical safeguards and implementation specifications (see HIPAA Privacy, Security, and Breach Notification Toolkit and Practice Note, HIPAA Security Rule). The order also requires the company to:
  • Pay $900,000 to the states over a three-year period.
  • Comply with the states' breach notification laws and PIPAs.
  • Implement a solution to identify and respond to malicious attacks on its systems.
  • Require multi-factor authentication:
    • to access any portals that the company manages in connection with its maintenance of ePHI; and
    • by the company's employees when remotely accessing the company's systems that store or permit access to ePHI.
  • Provide annual training to employees regarding the company's privacy and security policies (regarding HIPAA compliance training in the group health plan context, see Standard Document, HIPAA Training for Group Health Plans: Presentation Materials).
  • Develop and maintain policies and procedures that address responding to security incidents.
  • Hire a qualified certified information system security professional or certified information systems auditor to perform a risk analysis of the risks and vulnerabilities to the ePHI in its possession.
  • Designate a privacy officer or other official to ensure compliance with the court's order (see Standard Clause, Board Resolutions: Appointing HIPAA Privacy and Security Officer).

Practical Impact: Enforcement by State Attorneys General Under HITECH Act

According to a press release issued by the Tennessee Attorney's General office (one of the plaintiffs in the litigation) this case was the United States' "first-ever multistate lawsuit involving a HIPAA-related data breach." Under the Health Information Technology for Clinical and Economic Health (HITECH) Act, state attorneys general are expressly authorized to bring civil actions on behalf of state residents for violations of the HIPAA Privacy and Security Rules to:
  • Enjoin further violations of these requirements by offending parties.
  • Obtain damages on state residents' behalf.
(Pub. L. No. 111-5, § 13410(e) (2009).)
Damages in enforcement actions by state attorneys general are limited by statute, but a district court may award costs of the action and reasonable attorney's fees to a state. (The court's order in this litigation permits part of the settlement to be used for costs and attorney's fees.)
Given the prevalence of HIPAA enforcement activity by HHS, we wouldn't be surprised if there are additional enforcement actions by state attorneys general in the future (see Practice Note, HIPAA Enforcement: Settlement Agreements). (The HITECH Act requires some amount of coordination between the states and HHS in these enforcement actions. For example, the states generally must provide HHS prior written notice of enforcement actions that it undertakes, including a copy of related complaints.) The possibility of increased HIPAA enforcement by state attorneys general raises the stakes for HIPAA noncompliance – an area that is already the subject of multi-million dollar settlement agreements (see Legal Update, Anthem's $16 Million HIPAA Settlement Is Largest in History).