UNITED STATES DISTRICT COURT

NORTHERN DISTRICT OF INDIANA

FORT WAYNE DIVISION

JAMES YOUNG, IRA KUSHNER, ) Class Action Complaint

MARK GUTH, RICHARD LARSON, )

MATTHEW SMITH, JAMES ) Demand for Jury Trial

MUELLER, BRANDON WARRICK, )

MICHAEL OSBOURN, DAVID )

PERRY, on behalf of themselves and )

all others similarly situated, )

)

Plaintiffs, )

)

vs. ) No. 1:15-cv-00197-RLM-SLC

)

MEDICAL INFORMATICS )

ENGINEERING, INC., )

)

Defendant. )

AMENDED CLASS ACTION COMPLAINT

Plaintiffs, James Young, Ira Kushner, Mark Guth, Richard Larson, Matthew 

Smith, James Mueller, Brandon Warrick, Michael Osbourn, and David Perry by 

counsel, on behalf of themselves and all others similarly situated, allege:

NATURE OF THE CASE

1. Between approximately May 7, 2015 and May 26, 2015, Defendant 

Medical Informatics Engineering, Inc. (“MIE”) was subject to a data breach (the 

“MIE data breach”), when hackers stole the personal financial and protected health 

information of numerous individuals whose information was used in a MIE 

electronic health record. The personal and financial information obtained by the 

hackers includes name, telephone number, mailing address, username, hashed 

password, security question and answer, spousal information (name and potentially 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 1 of 31
2

date of birth), email address, date of birth, and Social Security number (“PII”). The 

protected health information obtained by the hackers includes lab results, health 

insurance policy information, diagnosis, disability code, doctor’s name, medical 

conditions, and child’s name and birth statistics (“PHI”).

2. MIE’s conduct––failing to take adequate and reasonable measures to 

ensure its data systems were protected, failing to take available steps to prevent 

and stop the breach from ever happening, failing to disclose to its customers the 

material facts that it did not have adequate computer systems and security 

practices to safeguard customers’ PII and PHI, and failing to provide timely and 

adequate notice of the MIE data breach––has caused substantial consumer harm 

and injuries to consumers across the United States.

3. As a result of the MIE data breach, numerous individuals whose PII 

and PHI was used in a MIE electronic health record have been exposed to fraud and 

these individuals have been harmed. The injuries suffered by the proposed Class as 

a direct result of the MIE data breach include: theft of their PII and PHI; costs 

associated with the detection and prevention of identity theft and medical identity 

theft and unauthorized use of their PII and PHI; costs associated with time spent 

and the loss of productivity from taking time to address and attempt to ameliorate, 

mitigate, and deal with the actual and future consequences of the data breach, 

including finding fraudulent charges, cancelling and reissuing cards, purchasing 

credit monitoring and identity theft protection services, imposition of withdrawal 

and purchase limits on compromised accounts, and the stress, nuisance, and 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 2 of 31
3

annoyance of dealing with all issues resulting from the MIE data breach; the 

imminent and certainly impending injury flowing from potential fraud and identify 

theft and medical identity theft posed by their PII and PHI being placed in the 

hands of hackers; damages to and diminution in value of their PII and PHI

entrusted to MIE for the sole purpose of maintaining electronic health records and 

with the mutual understanding that MIE would safeguard Plaintiff’s and Class 

members’ data against theft and not allow access and misuse of their data by 

others; and continued risk to their PII and PHI, which remains in the possession of 

MIE and which is subject to further breaches so long as MIE fails to undertake 

appropriate and adequate measures to protect Plaintiffs’ and Class members’ data 

in its possession.

4. Plaintiffs seek to remedy these harms, and prevent their future 

occurrence, on behalf of themselves and all similarly situated individuals whose PII 

and PHI was stolen as a result of the MIE data breach. Plaintiffs assert claims 

against MIE for violations of state consumer laws, negligence, breach of implied 

contract, bailment, and unjust enrichment. On behalf of themselves and all 

similarly situated consumers, Plaintiffs seek to recover damages, including actual 

and statutory damages, and equitable relief, restitution, disgorgement, costs, and 

reasonable attorney fees.

PARTIES

5. Plaintiff James Young is domiciled in Indiana and is a citizen of 

Indiana. Mr. Young received a letter from MIE informing him that his PII and PHI

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 3 of 31
4

was compromised as a result of the MIE data breach. Mr. Young was harmed by 

having his PII and PHI compromised.

6. Plaintiff Ira Kushner is domiciled in Arizona and is a citizen of 

Arizona. Mr. Kushner received a letter from MIE informing him that his PII and 

PHI was compromised as a result of the MIE data breach. Mr. Kushner was harmed 

by having his PII and PHI compromised.

7. Plaintiff Mark Guth is domiciled in Oregon and is a citizen of Oregon. 

Mr. Guth received a letter from MIE informing him that his PII and PHI was 

compromised as a result of the MIE data breach. Mr. Guth was harmed by having 

his PII and PHI compromised.

8. Plaintiff Richard Larson is domiciled in New Mexico and is a citizen of 

New Mexico. Mr. Larson received a letter from MIE informing him that his PII and 

PHI was compromised as a result of the MIE data breach. Mr. Larson was harmed 

by having his PII and PHI compromised.

9. Plaintiff Matthew Smith is domiciled in Michigan and is a citizen of 

Michigan. Mr. Smith received a letter from MIE informing him that his PII and PHI 

was compromised as a result of the MIE data breach. Mr. Smith was harmed by 

having his PII and PHI compromised.

10. Plaintiff James Mueller is domiciled in Virginia and is a citizen of 

Virginia. Mr. Mueller received a letter from MIE informing him that his PII and 

PHI was compromised as a result of the MIE data breach. Mr. Mueller was harmed 

by having his PII and PHI compromised.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 4 of 31
5

11. Plaintiff Brandon Warrick is domiciled in Texas and is a citizen of 

Texas. Mr. Warrick received a letter from MIE informing him that his PII and PHI 

was compromised as a result of the MIE data breach. Mr. Warrick was harmed by 

having his PII and PHI compromised.

12. Plaintiff Michael Osbourn is domiciled in Ohio and is a citizen of Ohio. 

Mr. Osbourn received a letter from MIE informing him that his PII and PHI was 

compromised as a result of the MIE data breach. Mr. Osbourn was harmed by 

having his PII and PHI compromised.

13. Plaintiff David Perry is domiciled in Georgia and is a citizen of 

Georgia. Mr. Perry received a letter from MIE informing him that his PII and PHI 

was compromised as a result of the MIE data breach. Mr. Perry was harmed by 

having his PII and PHI compromised.

14. Plaintiffs would not have given, or not allowed MIE to be given, their

PII or PHI had MIE told them that it lacked adequate computer systems and data 

security practices to safeguard customers’ PII and PHI from theft.

15. Plaintiffs suffered actual injury from having their PII and PHI 

compromised and stolen in and as a result of the MIE data breach.

16. Defendant MIE is a citizen of Indiana. MIE is a corporation that is 

incorporated in Indiana and has its principal place of business in Indiana at 6302 

Constitution Drive, Fort Wayne, IN 46804. MIE is a software developer that 

provides technical solutions targeted to the healthcare industry. Among other 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 5 of 31
6

products and services targeted to the healthcare industry, MIE provides an 

electronic medical record system.

JURISDICTION & VENUE

17. This Court has diversity jurisdiction under the Class Action Fairness 

Act, 28 U.S.C. § 1332(d), because this is a class action involving more than 100 class 

members, the amount in controversy exceeds $5,000,000, exclusive of interest and 

costs, and many members of the class are citizens of states different from the 

Defendant.

18. Venue is proper in this Court pursuant to 28 U.S.C. § 1391 because 

MIE is headquartered here and regularly transacts business here; and some of the 

Class members reside in this district. The causes of action for the putative Class 

Members also arose, in part, in this district.

CLASS ACTION ALLEGATIONS

19. Plaintiffs bring all claims as class claims under Federal Rule of Civil 

Procedure 23. The requirements of Federal Rule of Civil Procedure 23(a) and 

23(b)(3) are met with respect to the Class defined below.

20. The Plaintiff Class consists of all persons whose PII or PHI was 

compromised by the MIE data breach (“Nationwide Class”).

21. Alternatively, Plaintiffs propose the following subclasses by state or 

groups of states: “All persons in [NAME OF STATE(S)] whose PII or PHI was 

compromised by the MIE data breach” (“Statewide Class”).

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 6 of 31
7

22. The Class is so numerous that joinder of all members is impracticable. 

The Class includes approximately 4 million individuals whose PII and PHI was 

compromised by the MIE data breach.

23. There are numerous questions of law and fact common to Plaintiffs

and the Class, including the following:

 whether MIE engaged in the wrongful conduct alleged herein;

 whether MIE’s conduct was deceptive, unfair, unconscionable and/or 

unlawful;

 whether MIE owed a duty to Plaintiffs and members of the Class to 

adequately protect their PII and PHI and to provide timely and accurate 

notice of the MIE data breach to Plaintiffs and members of the Class;

 whether MIE breached its duties to protect the PII and PHI of Plaintiffs and 

members of the Class by failing to provide adequate data security and 

whether MIE breached its duty to provide timely and accurate notice to 

Plaintiffs and members of the Class;

 whether MIE knew or should have known that its computer systems were 

vulnerable to attack;

 whether MIE’s conduct, including its failure to act, resulted in or was the 

proximate cause of the breach of its systems, resulting in the loss of the PII 

and PHI; 

 whether MIE unlawfully failed to inform Plaintiffs and members of the Class 

that it did not maintain computers and security practices adequate to 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 7 of 31
8

reasonably safeguard PII and PHI and whether MIE failed to inform 

Plaintiffs and members of the Class of the data breach in a timely and 

accurate manner;

 whether Plaintiffs and members of the Class suffered injury, including 

ascertainable losses, as a result of MIE’s conduct (or failure to act);

 whether Plaintiffs and members of the Class are entitled to recover damages;

 whether Plaintiffs and Class members are entitled to equitable relief, 

including injunctive relief, restitution, disgorgement, and/or other equitable 

relief.

24. Plaintiffs’ claims are typical of the claims of the Class in that the 

representative Plaintiffs, like all Class members, had their PII and PHI

compromised in the MIE data breach.

25. Plaintiffs will fairly and adequately protect the interests of the Class.

Plaintiffs have retained counsel who is experienced in class-action and complex

litigation. Plaintiffs have no interests that are adverse to, or in conflict with, other 

members of the Class.

26. The questions of law and fact common to the Class Members 

predominate over any questions which may affect only individual members.

27. A class action is superior to other available methods for the fair and

efficient adjudication of the controversy. Class treatment of common questions of 

law and fact is superior to multiple individual actions or piecemeal litigation. 

Moreover, absent a class action, most Class Members would likely find the cost of 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 8 of 31
9

litigating their claims prohibitively high and would therefore have no effective 

remedy.

28. The prosecution of separate actions by the individual Class members 

would create a risk of inconsistent or varying adjudications with respect to 

individual Class members, which would establish incompatible standards of conduct 

for MIE. In contrast, the conduct of this action as a class action presents far fewer 

management difficulties, conserves judicial resources and the parties’ resources, 

and protects the rights of each Class member.

FACTS

I. The Healthcare Industry is Put on Notice of Cyber Attacks

29. Companies that provide electronic health record services to the 

healthcare industry, like MIE, have an obligation to maintain the security of 

individuals’ PII and PHI, which MIE itself recognizes in its Privacy Policy on its 

website, http://www.mieweb.com/privacy (last visited July 29, 2015):

Effective Date: February 18, 2010

At Medical Informatics Engineering (MIE), protecting your privacy is 

of the utmost importance. Information furnished by you to us will be 

treated with the greatest respect and in accordance with this Privacy 

Policy. Please find below details about our practices for handling and 

securing your personal information. In this policy, “personal

information” refers to names, home and office contact information and 

any other “information relating to an identified or identifiable natural 

person.”

. . . This privacy policy applies collectively to MIE’s security practices 

and to all data collected by, used by or exchanged among any of the 

MIE’s legal entities. . . .

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 9 of 31
10

WHAT INFORMATION DO WE COLLECT?

. . .

2. Personal Information Collection

Medical Informatics Engineering may ask for personal or business 

information in order to assist us in meeting your various needs, 

including:

o providing products or services requested;

o servicing your account;

o improving our services; and

o developing and/or informing you of additional products or 

services that may be of interest

Information sought by Medical Informatics Engineering may depend 

on the product or service requested. As a result, Medical Informatics 

Engineering may request personal information including name, street 

address, ZIP Code, telephone number, fax number, email address, and 

area of practice or degree (if applicable). Medical Informatics 

Engineering may collect other personal information through 

comments, feedback, participation in surveys, or other requests for 

information.

Further personal information may be required during the application 

and underwriting process. That information may include, among other 

things, claim payments, loss history or other underwriting information, 

credit card numbers, bank account information or social security 

numbers. In certain circumstances, we may require information 

primarily used for individual, family or household purposes.

. . .

WHAT INFORMATION DO WE SHARE AND WITH WHOM DO WE 

SHARE IT?

Medical Informatics Engineering may share personal information with 

our affiliated companies and third parties for the purpose of fulfilling 

your requests, or to offer you other products and services that may be 

of interest to you. Medical Informatics Engineering may or may not 

receive compensation for sharing such information in this manner. 

Medical Informatics Engineering reserves the right to use this 

information and to disclose it to others to the extent permitted or 

required by law, to investigate potential wrongdoing, or to protect the 

rights, property or safety of Medical Informatics Engineering or others.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 10 of 31
11

. . .

HOW IS YOUR INFORMATION SECURED AND PROTECTED?

Medical Informatics Engineering uses encryption and authentication 

tools (password and user identification) to protect your personal 

information. However, emails sent via the Site may not be secure 

during transmission. If your communication is very sensitive, or 

includes highly confidential information such as a credit card number 

or premium or loss information, you may want to send it by regular 

mail or verify that encryption is used.

Our employees are aware that certain information provided by our 

customers is confidential and is to be protected. Employees who misuse 

customer information are subject to disciplinary action.

. . .

30. The New York Times reports that “[t]he threat of a hacking is 

particularly acute in the health care and financial services industry, where 

companies routinely keep the most sensitive personal information about their 

customers on large databases.” (http://www.nytimes.com/2015/02/05/business/

hackers-breached-data-of-millions-insurer-says.html (last visited Feb. 5, 2015).)

31. Indeed, on April 8, 2014, the FBI’s Cyber Division issued a public 

Private Industry Notification titled “Health Care Systems and Medical Devices at 

Risk for Increased Cyber Intrusions for Financial Gain.” The notification specifically 

cautioned that “[c]yber actors will likely increase cyber intrusions against health 

care systems . . . due to . . . lax cybersecurity standards, and a higher financial 

payout for medical records in the black market.” 

32. The FBI cited a report issued in February 2014 by SANS, a leading 

computer forensics and security firm, warning:

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 11 of 31
12

Health care security strategies and practices are poorly protected and 

ill-equipped to handle new cyber threats exposing patient medical 

records, billing and payment organizations, and intellectual property. . 

. . The biggest vulnerability was the perception of IT health care 

professionals’ beliefs that their current perimeter defenses and 

compliance strategies were working when clearly the data states 

otherwise.

33. By early 2014 computer breaches had become rampant in the 

healthcare industry, a fact widely disseminated inside and outside the healthcare 

sector. For example:

 According to a Ponemon Institute report dated March 2013, 63% of the 

healthcare organizations surveyed reported a data breach during the 

previous two years. The majority of these breaches resulted in the theft of 

data. In a March 2014 report, the institute stated that criminal attacks on 

healthcare companies have increased 100% since 2010.

 An EMC2/RSA White Paper published in 2013 indicated that during the first 

half of 2013, more than two million healthcare records were compromised, 

which was 31% of all reported data breaches. 

 According to the Identity Theft Resource Center, nearly half of all data 

breaches so far in 2014 have taken place in the healthcare sector.

 According to a recent analysis of HHS data by the Washington Post’s 

“Wonkblog,” the personal data of about 30.1 million people has been affected 

by 944 recorded “major” health data breaches (defined by HHS as one 

affecting at least 500 people) since federal reporting requirements under the 

2009 economic stimulus package went into effect. This analysis did not 

include the CHS breach.

 In early 2015, Anthem and was the victim of a data breach that affected 

nearly 80 million individuals.

 In early 2015, Premera Blue Cross was also the victim of a data breach.

34. Several other studies have shown the healthcare industry to be one of 

the most affected by and least prepared to deal with hacking attempts. Despite the 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 12 of 31
13

growing threat, the healthcare industry has been slow to implement improved 

security measures – slower than other industries handling sensitive information, 

such as the retail and financial sectors. For instance, the typical healthcare entity 

allocates only about 2 or 3 percent of its operating budget to its IT department, 

while retail and financial businesses devote more than 20 percent to IT. According 

to an annual security assessment conducted by the Healthcare Information and 

Management Systems Society, almost half of surveyed health systems said they 

spent 3 percent or less of their IT budgets on security.

II. The MIE Data Breach

35. On June 10, 2015, MIE announced that it was the victim of a “data 

security compromise that has affected the security of some personal and protected 

health information relating to certain clients and individuals who have used a 

Medical Informatics Engineering electronic health record.” (http://www.mieweb.com

/notice/ (last visited July 29, 2015).)

36. On July 23, 2015, MIE provided additional information about the MIE 

data breach:

On May 26, 2015, we discovered suspicious activity in one of our 

servers. We immediately began an investigation to identify and 

remediate any identified security vulnerability. Our first priority was 

to safeguard the security of personal and protected health information, 

and we have been working with a team of third-party experts to 

investigate the attack and enhance data security and protection. This 

investigation is ongoing. On May 26, 2015, we also reported this 

incident to law enforcement including the FBI Cyber Squad. Law 

enforcement is actively investigating this matter, and we are 

cooperating fully with law enforcement's investigation. The 

investigation indicates this is a sophisticated cyber attack. Our 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 13 of 31
14

forensic investigation indicates the unauthorized access to our network 

began on May 7, 2015. Our monitoring systems helped us detect this 

unauthorized access, and we were able to shut down the attackers as 

they attempted to access client data.

We are continuing to take steps to remediate and enhance the security 

of our systems. Remedial efforts include removing the capabilities used 

by the intruder to gain unauthorized access to the affected systems, 

enhancing and strengthening password rules and storage mechanisms, 

increased active monitoring of the affected systems, and intelligence 

exchange with law enforcement. We have also instituted a universal 

password reset.

(http://www.mieweb.com /notice/ (last visited July 29, 2015).)

37. MIE’s website then stated that “[w]hile investigations into this 

incident are ongoing,” thus far it has been “determined the security of some 

personal and protected health information contained on Medical Informatics 

Engineering’s network has been affected. The affected data relating to individuals 

affiliated with affected Medical Informatics Engineering clients may include an 

individual's name, telephone number, mailing address, username, hashed 

password, security question and answer, spousal information (name and potentially 

date of birth), email address, date of birth, Social Security number, lab results, 

health insurance policy information, diagnosis, disability code, doctor's name, 

medical conditions, and child's name and birth statistics.” (http://www.mieweb.com/

notice/ (last visited July 29, 2015).)

38. MIE notified the FBI of the breach and the FBI is investigating. 

39. MIE detected the breach on May 26, 2015, but did not publicly 

announce the breach until June 10, 2015.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 14 of 31
15

40. MIE did not start mailing notification to affected individuals until July 

17, 2015.

41. MIE’s website states that “[t]he following healthcare providers were 

affected by the Medical Informatics Engineering cyber attack”:

 Concentra

 Allied Physicians, Inc. d/b/a Fort Wayne Neurological Center (including 

Neurology, Physical Medicine and Neurosurgery)

 Franciscan St. Francis Health Indianapolis

 Gynecology Center, Inc. Fort Wayne

 Rochester Medical Group

 RediMed

 Fort Wayne Radiology Association, LLC including d/b/a Nuvena Vein Center 

and Dexa Diagnostics

 Open View MRI, LLC

 Breast Diagnostic Center, LLC

 P.E.T. Imaging Services, LLC

 MRI Center — Fort Wayne Radiology, Inc. (f/k/a Advanced Imaging Systems, 

Inc.)

42. MIE’s website also states that “[i]ndividuals who received services 

from Fort Wayne Radiology Association, Open View, Breast Diagnostic Center, PET 

Imaging or MRI Center during the period of time from January 1, 1997 to May 26, 

2015 may be affected. The database relating to these healthcare providers was 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 15 of 31
16

accessed on May 26, 2015. Individuals may also visit the providers’ websites, which 

may be accessed at www.fwradiology.com, for information on this incident.”

43. MIE’s website also states that “[a]ffected individuals may include, 

along with potential others, individuals who received radiology services during this 

time at any of the organizations identified below:

Accustat Medical Lab, Inc. Indianapolis, IN

Allergy & Asthma Center Fort Wayne, IN

Associated Physicians & Surgeons Clinic, LLC Terre Haute, IN

Ball Memorial Hospital Muncie, IN

Bedford Regional Medical Center Bedford, IN

Cameron Memorial Community Hospital Angola, IN

Central Indiana Orthopedics, PC Muncie, IN

Community Memorial Hospital Hicksville, OH

Ear, Nose & Throat Associates Fort Wayne, IN

Family Medicine Associates, Jerry Sell, M.D. Rockford, OH

First Care Family Physicians Fort Wayne, IN

Fort Wayne Medical Oncology & Hematology Fort Wayne, IN

Gary Pitts, M.D. Warsaw, IN

Indiana Urgent Care Centers, LLC Indianapolis, IN

Indiana University Health Center Bloomington, IN

Jasper County Hospital Rensselaer, IN

Manchester Family Physicians North Manchester, IN

MedCorp Toledo, OH

Meridian Health Group Carmel, IN

Nationwide Mobile Imaging Fort Wayne, IN

Neighborhood Health Clinic Fort Wayne, IN

Orthopaedics Northeast Fort Wayne, IN

Parkview Regional Medical Center Fort Wayne, IN

Parkview Hospital Fort Wayne, IN

Parkview Ortho Hospital Fort Wayne, IN

Parkview Heart Institute Fort Wayne, IN

Parkview Women & Children's Hospital Fort Wayne, IN

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 16 of 31
17

Parkview Noble Hospital Kendallville, IN

Parkview Huntington Hospital Huntington, IN

Parkview Whitley Hospital Columbia City, IN

Parkview LaGrange Hospital LaGrange, IN

Parkview Physicians Group

Parkview Occupational Health Centers

Paulding County Hospital Paulding, OH

Prompt Care Express Coldwater, MI; Sturgis, MI

Public Safety Medical Services Indianapolis, IN

Purdue University Health Center W. Lafayette, IN

Southwestern Medical Clinics Berrien Springs, MI

Tri-State Medical Imaging Angola, Indiana

Union Associated Physicians Clinic Terre Haute, IN

U.S. Healthworks Medical Group of Indiana Elkhart, IN

Van Wert County Hospital Van Wert, OH

Wabash County Hospital Wabash, IN

Wabash Family Care Wabash, IN

44. MIE’s website also provides “[f]raud prevention tips” that show just 

how damaging the MIE data beach is to class members:

We suggest affected individuals remain vigilant and seek to protect 

against possible identity theft or other financial loss by regularly 

reviewing their financial account statements for suspicious activity. 

We also encourage affected individuals to notify their credit card 

companies, health care providers, and heath care insurers of this data 

security incident. Affected individuals may also review explanation of 

benefits statement(s) that they receive from their healthcare provider 

or health plan. If an affected individual sees any service that he/she 

believes he/she did not receive, the individual should contact his/her 

health care provider or health plan at the telephone number listed on 

the explanation of benefits statement(s). If an affected individual does 

not receive regular explanation of benefits statement(s), we suggest 

he/she contact his/her healthcare provider or health plan and ask that 

they send a copy after each visit the affected individual makes with 

his/her health care provider.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 17 of 31
18

We also suggest that affected individuals carefully review their credit 

reports. Under U.S. law, individuals are entitled to one free credit 

report annually from each of the three major credit bureaus. To obtain 

a free credit report, visit www.annualcreditreport.com or call, tollfree, (877) 322-8228.

At no charge, individuals can also have these credit bureaus place a 

"fraud alert" on their file that alerts creditors to take additional steps 

to verify the his/her identity prior to granting credit in his/her name. 

Please note, however, that because it tells creditors to follow certain 

procedures to protect an individual's credit, it may also delay the 

ability to obtain credit while the agency verifies the individual's 

identity.

(http://www.mieweb.com/notice/ (last visited July 29, 2015).)

COUNT I – NEGLIGENCE

ON BEHALF OF THE NATIONWIDE CLASS, 

OR ALTERNATIVELY, THE STATEWIDE CLASSES

45. Plaintiffs incorporate by reference those paragraphs set out above as if 

fully set forth herein.

46. MIE owed a duty to Plaintiffs and members of the Class to exercise 

reasonable care in obtaining, retaining, securing, safeguarding, deleting and 

protecting their PII and PHI in its possession from being compromised, lost, stolen, 

accessed, and misused by unauthorized persons. This duty included, among other 

things, designing, maintaining, and testing MIE’s security systems to ensure that 

Plaintiffs’ and Class members’ PII and PHI in MIE’s possession was adequately 

secured and protected. MIE further owed a duty to Plaintiffs and Class members to 

implement processes that would detect a breach of its security system in a timely 

manner and to timely act upon warnings and alerts.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 18 of 31
19

47. MIE owed a duty, as articulated in in its own Privacy Policy, to protect 

its customers’ PII and PHI.

48. MIE owed a duty to timely disclose the material fact that MIE’s

computer systems and data security practices were inadequate to safeguard 

individuals’ PII and PHI. 

49. MIE breached these duties by the conduct alleged in the Complaint by, 

including without limitation, (a) failing to protect its customers’ PII and PHI; (b) 

failing to maintain adequate computer systems and data security practices to 

safeguard customers’ PII and PHI; (c) failing to disclose the material fact that MIE’s

computer systems and data security practices were inadequate to safeguard 

customers’ PII and PHI; and (d) failing to disclose in a timely and accurate manner 

to Plaintiffs and members of the Class the material fact of the MIE data breach.

50. The conduct alleged in the Complaint caused Plaintiffs and Class 

members to be exposed to fraud and be harmed. The injuries suffered by the 

Plaintiffs and the proposed Class as a direct result of the MIE data breach include: 

theft of their PII and PHI; costs associated with the detection and prevention of 

identity theft and medical identity theft and unauthorized use of their financial 

accounts and medical identity; costs associated with time spent and the loss of 

productivity from taking time to address and attempt to ameliorate, mitigate, and 

deal with the actual and future consequences of the data breach, including finding 

fraudulent charges, cancelling and reissuing cards, purchasing credit monitoring 

and identity theft protection services, imposition of withdrawal and purchase limits 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 19 of 31
20

on compromised accounts, and the stress, nuisance and annoyance of dealing with 

all issues resulting from the MIE data breach; the imminent and certainly 

impending injury flowing from potential fraud and identify theft posed by their PII 

and PHI being placed in the hands of hackers; damages to and diminution in value 

of their PII and PHI entrusted to MIE with the mutual understanding that MIE

would safeguard Plaintiffs’ and Class members’ data against theft and not allow 

access and misuse of their data by others; and continued risk to their PII and PHI, 

which remains in the possession of MIE and which is subject to further breaches so 

long as MIE fails to undertake appropriate and adequate measures to protect 

Plaintiffs’ and Class members’ data in its possession.

COUNT II – BREACH OF IMPLIED CONTRACT ON BEHALF OF THE 

NATIONWIDE CLASS, OR ALTERNATIVELY, THE STATEWIDE CLASSES

51. Plaintiffs incorporate by reference those paragraphs set out above as if 

fully set forth herein.

52. When Plaintiffs and members of the Class provided their PII and PHI

to MIE, Plaintiffs and members of the Class entered into implied contracts with 

MIE pursuant to which MIE agreed to safeguard and protect such information and 

to timely and accurately notify Plaintiffs and Class members that their data had 

been breached and compromised.

53. Plaintiffs and Class members would not have provided and entrusted 

their PII and PHI to MIE in the absence of the implied contract between them and 

MIE.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 20 of 31
21

54. Plaintiffs and members of the Class fully performed their obligations

under the implied contracts with MIE.

55. MIE breached the implied contracts it made with Plaintiffs and Class 

members by failing to safeguard and protect the PII and PHI of Plaintiff and

members of the Class and by failing to provide timely and accurate notice to them 

that their PII and PHI was compromised in and as a result of MIE data breach.

56. The losses and damages sustained by Plaintiffs and Class members as 

described herein were the direct and proximate result of MIE’s breaches of the 

implied contracts between MIE and Plaintiffs and members of the Class.

COUNT III – BREACH OF CONTRACT ON BEHALF OF THE NATIONWIDE 

CLASS, OR ALTERNATIVELY, THE STATEWIDE CLASSES

57. Plaintiffs incorporate by reference those paragraphs set out above as if 

fully set forth herein.

58. MIE has a contractual obligation to maintain the security of its 

customers’ PII and PHI, which MIE itself recognizes in its Privacy Policy.

59. MIE breached that contractual obligation by failing to safeguard and 

protect the PII and PHI of Plaintiffs and members of the Class and by failing to 

provide timely and accurate notice to them that their PII and PHI was compromised 

in and as a result of MIE data breach.

60. The losses and damages sustained by Plaintiffs and Class members as 

described herein were the direct and proximate result of MIE’s breaches of the 

contracts between MIE and Plaintiffs and members of the Class.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 21 of 31
22

COUNT IV – BAILMENT ON BEHALF OF THE NATIONWIDE CLASS, 

OR ALTERNATIVELY, THE STATEWIDE CLASSES

61. Plaintiffs incorporate by reference those paragraphs set out above as if 

fully set forth herein.

62. In having their PII and PHI delivered to MIE for the purposes of 

electronic health records, Plaintiffs and Class members intended and understood 

that MIE would adequately safeguard their personal and financial information.

63. MIE accepted possession of Plaintiffs’ and Class members’ PII and PHI

for the purpose of providing electronic health record services.

64. By accepting possession of Plaintiffs’ and Class members’ PII and PHI, 

MIE understood that Plaintiffs and Class members expected MIE to adequately 

safeguard their PII and PHI. Accordingly, a bailment (or deposit) was established 

for the mutual benefit of the parties.

65. During the bailment (or deposit), MIE owed a duty to Plaintiffs and

Class members to exercise reasonable care, diligence, and prudence in protecting 

their PII and PHI.

66. MIE breached its duty of care by failing to take appropriate measures 

to safeguard and protect Plaintiffs’ and Class members’ PII and PHI, resulting in 

the unlawful and unauthorized access to and misuse of Plaintiffs’ and Class 

members’ PII and PHI.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 22 of 31
23

67. MIE further breached its duty to safeguard Plaintiffs’ and Class

members’ PII and PHI by failing to timely and accurately notify them that their 

information had been compromised as a result of the MIE data breach.

COUNT V – UNJUST ENRICHMENT ON BEHALF OF THE NATIONWIDE 

CLASS, OR ALTERNATIVELY, THE STATEWIDE CLASSES

68. Plaintiffs incorporate by reference those paragraphs set out above as if 

fully set forth herein.

69. Plaintiffs and Class members conferred a benefit on MIE by way of 

customers’ paying MIE to maintain Plaintiffs and Class members’ PII and PHI.

70. The monies paid to MIE were supposed to be used by MIE, in part, to 

pay for the administrative and other costs of providing reasonable data security and 

protection to Plaintiffs and Class members.

71. MIE failed to provide reasonable security, safeguards, and protections 

to the PII and PHI of Plaintiffs and Class members, and as a result MIE was 

overpaid. 

72. Under principles of equity and good conscience, MIE should not be 

permitted to retain the money because MIE failed to provide adequate safeguards 

and security measures to protect Plaintiffs’ and Class members’ PII and PHI that 

they paid for but did not receive.

73. MIE wrongfully accepted and retained these benefits to the detriment 

of Plaintiffs and Class Members.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 23 of 31
24

74. MIE’s enrichment at the expense of Plaintiffs and Class Members is

and was unjust.

75. As a result of MIE’s wrongful conduct, as alleged above, Plaintiffs and

the Class are entitled to restitution and disgorgement of profits, benefits, and other

compensation obtained by MIE, plus attorneys’ fees, costs, and interest thereon.

COUNT VI – VIOLATION OF INDIANA DECEPTIVE CONSUMER SALES 

ACT ON BEHALF OF THE NATIONWIDE CLASS

76. Plaintiffs incorporate by reference those paragraphs set out above as if 

fully set forth herein.

77. MIE’s conduct as alleged in this Complaint violated Ind. Code § 24-5-

0.5-3(b)(1), (2), including without limitation that (a) MIE represented that it 

protected its customers’ PII and PHI, but MIE failed to protect that information; (b) 

MIE’s failure to maintain adequate computer systems and data security practices to 

safeguard customers’ PII and PHI; (c) MIE’s failure to disclose the material fact 

that MIE’s computer systems and data security practices were inadequate to 

safeguard customers’ PII and PHI from theft; and (d) MIE’s failure to disclose in a 

timely and accurate manner to Plaintiff and members of the Class the material fact 

of the MIE data breach.

78. Plaintiffs and Class members relied on MIE’s misrepresentations.

79. MIE’s deceptive acts were done as part of a scheme, artifice, or device 

with intent to defraud or mislead and constitute incurable deceptive acts under Ind. 

Code § 24-5-0.5-1 et seq.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 24 of 31
25

80. Plaintiffs and Class members are entitled to $1,000 or treble damages, 

reasonable attorneys’ fees, costs of suit, an ordering enjoining MIE’s unlawful 

practices, and any other relief which the Court deems proper.

COUNT VII - VIOLATION OF STATE CONSUMER LAWS ON BEHALF OF 

THE STATEWIDE CLASSES

81. Plaintiffs incorporate by reference those paragraphs set out above as if 

fully set forth herein.

82. Plaintiffs and Class members are consumers whose interaction with 

MIE was primarily for personal, family, or household purposes.

83. MIE engaged in the conduct alleged in this Complaint in transactions 

intended to result, and which did result, in the sale of goods or services to 

consumers, including Plaintiffs and members of the Class.

84. MIE is engaged in, and its acts and omissions affect, trade and 

commerce. MIE’s acts, practices, and omissions were done in the course of MIE’s

business of marketing, offering for sale, and selling goods and services throughout 

the United States, including in Indiana.

85. MIE’s conduct as alleged in this Complaint, including without 

limitation that (a) MIE represented that it protected its customers’ PII and PHI, but 

MIE failed to protect that information; (b) MIE failed to maintain adequate 

computer systems and data security practices to safeguard customers’ PII and PHI; 

(c) MIE failed to disclose the material fact that MIE’s computer systems and data 

security practices were inadequate to safeguard customers’ PII and PHI from theft; 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 25 of 31
26

and (d) MIE failed to disclose in a timely and accurate manner to Plaintiffs and 

members of the Class the material fact of the MIE data breach, constitutes unfair 

methods of competition and unfair, deceptive, unconscionable, fraudulent, and/or 

unlawful acts or practices.

86. By engaging in such conduct and omissions of material facts, MIE has 

violated state consumer law prohibiting representing that “goods or services have 

sponsorship, approval, characteristics, ingredients, uses, benefits, or quantities that 

they do not have,” representing that “goods and services are of a particular 

standard, quality or grade, if they are of another,” and/or “engaging in any other 

conduct which similarly creates a likelihood of confusion or of misunderstanding;” 

and state consumer protection laws prohibiting unfair methods of competition and 

unfair, deceptive, unconscionable, fraudulent, and/or unlawful acts or practices.

87. The Plaintiffs and Class members suffered damages, ascertainable 

losses and injuries, including to their money and property, as a direct result of 

MIE’s unfair methods of competition, unfair, deceptive, unconscionable, fraudulent, 

and/or unlawful acts or practices.

88. MIE’s conduct described in this Complaint violates the following state 

consumer statutes:

a. The Arizona Consumer Fraud Act, A.R.S. § 44-1522;

b. The Georgia Fair Business Practices Act, Ga. Code Ann. §§ 10-1-393(a) 

and (b)(2), (5) and (7) et seq.;

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 26 of 31
27

c. The Michigan Consumer Protection Act, M.C.P.L.A. § 445.903(1)(c)(e), 

(s) and (cc), et seq.;

d. The New Mexico Unfair Practices Act, N.M. Stat. Ann. §§ 57-12-

2(D)(5)(7) and (14) and 57-12-3, et seq.;

e. The Ohio Consumer Sales Practices Act, Ohio Rev. Code Ann. § 

1345.02(A) and (B)(1) and (2) et seq. Pursuant to Ohio Rev. Code Ann. § 

1345.09(B), MIE’s alleged acts must have been previously declared to 

be deceptive or unconscionable under Ohio Rev. Code Ann. §§ 1345.02 

or 1345.03. As alleged in the Complaint, MIE omitted material 

disclosures that it did not have adequate security to safeguard 

customers’ PII and PHI; did not timely notify consumers of the data 

breach; and did not timely act when notified of suspicious activity on 

its computer systems. Ohio courts have previously declared such 

actions to be deceptive or unconscionable under §§ 1345.02 or 1345.03.

f. The Oregon Unfair Trade Practices Act, Or. Rev. Stat. § 

646.608(1)(e)(g) and (u), et seq.;

g. The Texas Deceptive Trade Practices- Consumer Protection Act, 

V.T.C.A., Bus. & C. § 17.46(a), (b)(5) and (7), et seq.; and

h. The Virginia Consumer Protection Act, Va. Code Ann. § 59.1-

200(A)(5)(6) and (14), et seq.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 27 of 31
28

89. Plaintiffs and Class members are entitled to damages, reasonable 

attorneys’ fees, costs of suit, an order enjoining MIE’s unlawful practices, and any 

other relief which the Court deems proper.

COUNT VIII - VIOLATION OF STATE DATA BREACH STATUTES ON 

BEHALF OF THE STATEWIDE CLASSES

90. Plaintiffs incorporate by reference those paragraphs set out above as if 

fully set forth herein.

91. Legislatures in the states and jurisdictions listed below have enacted 

data breach statutes. These statutes generally require that any person or business 

conducting business within the state that owns or licenses computerized data that 

includes PII or PHI shall disclose any breach of the security of the system to any 

resident of the state whose personal information was acquired by an unauthorized 

person, and further require that the disclosure of the breach be made in the most 

expedient time possible and without unreasonable delay.

92. The MIE data breach constituted a breach of the security system of 

MIE within the meaning of the below state data breach statutes and the data 

breached was protected and covered by the below data breach statutes.

93. MIE unreasonably delayed in informing the public, including the 

Plaintiffs and the Class members about the breach of the security of Plaintiffs’ and 

Class members’ PII and PHI after MIE knew or should have known that the data 

breach had occurred. 

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 28 of 31
29

94. MIE failed to disclose to Plaintiffs and Class members without

unreasonable delay and in the most expedient time possible, the breach of security 

of Plaintiffs’ and Class members’ PII and PHI when MIE knew or reasonably 

believed such information had been compromised.

95. Had MIE provided timely and accurate notice, Plaintiffs and Class 

members could have avoided or mitigated the harm caused by the MIE data breach. 

For example, they could have taken earlier security precautions in time to prevent 

or minimize identity theft.

96. MIE’s failure to provide timely and accurate notice of the MIE data 

breach violated the following state data breach statutes:

a. Ga. Code Ann. § 10-1-912(a), et seq.;

b. Or. Rev. Stat. Ann. § 646A.604(1), et seq.;

c. Mich. Comp. Laws Ann. § 445.72(1), et seq.;

d. Va. Code. Ann. § 18.2-186.6(B), et seq.; and

e. Tex. Bus. & Com. Code Ann. § 521.053(b), et seq.

97. Plaintiffs and members of each of the Statewide Classes seek all 

remedies available under their respective state data breach statutes, including but

not limited to a) damages suffered by Plaintiffs and Class members as alleged 

above, b) equitable relief, including injunctive relief, and c) reasonable attorneys’

fees and costs, as provided by law.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 29 of 31
30

RELIEF REQUESTED

Plaintiffs, on behalf of themselves and all others similarly situated, request 

that the Court enter judgment against MIE, as follows:

1. An award to Plaintiffs and the Class of compensatory, direct, 

consequential, statutory, and incidental damages;

2. An award of attorneys’ fees, costs, and expenses, as provided by law, or

equity, or as otherwise available;

3. An award of pre-judgment and post-judgment interest, as provided by 

law or equity; and

4. Such other or further relief as may be appropriate under the 

circumstances.

DEMAND FOR JURY TRIAL

Plaintiffs demand a trial by jury of any and all issues in this action so triable 

of right.

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 30 of 31
31

Dated: August 14, 2015 Respectfully submitted,

/s/ Irwin B. Levin

Irwin B. Levin, No. 8786-49

Richard E. Shevitz, No. 12007-49

Vess A. Miller, No. 26495-53

Lynn A. Toops, No. 26386-49A

COHEN & MALAD, LLP

One Indiana Square, Suite 1400

Indianapolis, IN 46204

Telephone: (317) 636-6481

Fax: (317) 636-2593

ilevin@cohenandmalad.com

rshevitz@cohenandmalad.com

vmiller@cohenandmalad.com

ltoops@cohenandmalad.com

Mark E. GiaQuinta, No. 7119-02

Holly A. Brady, No. 18227-02A

HALLER & COLVIN, P.C.

444 East Main Street

Fort Wayne, IN 46802

Telephone: (260) 426-0444

Fax: (260) 422-0274

mgiaquinta@hallercolvin.com

hbrady@hallercolvin.com

Counsel for Plaintiffs and the 

Proposed Plaintiff Class

USDC IN/ND case 1:15-cv-00197-RLM-SLC document 13 filed 08/14/15 page 31 of 31