Source: https://www.privacyanddatasecurityinsight.com/2019/01/indiana-business-owners-may-now-face-million-dollar-lawsuits-from-data-breach-victims/
Timestamp: 2019-04-26 08:41:49+00:00

Document:
The Indiana Attorney General recently asserted a novel claim under the Indiana Deceptive Consumer Sales Act that, if successful, opens the door for data breach victims to file class action lawsuits and recover $500 or more per person in statutory damages and attorney’s fees. Damages can add up fast as a data breach involving 2,000 people could result in $1,000,000 in damages, not including attorney’s fees. Data breaches may also result in a lawsuit by the Attorney General for civil penalties, attorney fees, and injunctive relief. Now is the perfect time to consider hardening your company’s cyber security defenses and increasing your cyber insurance policy limits.
To date, no court interpreting Indiana law has applied the Indiana Deceptive Consumer Sales Act (the “Act”), Ind. Code § 24-5-0.5, to data breaches. However, by its express terms, the Act is “liberally construed and applied to … protect consumers from suppliers who commit deceptive and unconscionable sales acts….” IC § 24-5-0.5-1. A “supplier” is defined as someone who regularly engages in or solicits consumer transactions, and includes manufacturers, wholesalers, and retailers, regardless of whether the person deals directly with the consumer. IC § 24-5-0.5-(a)(3)(A). An “incurable deceptive act” is defined as “a deceptive act done by a supplier as part of a scheme with intent to defraud of mislead.” IC § 24-5-0.5-2(a)(7). Under the Act, “[a] supplier may not commit an unfair, abusive, or deceptive act, omission, or practice in connection with a consumer transaction,” regardless of “whether it occurs before, during, or after the transaction.” IC § 24-5-0.5-3(a).
The victim of an incurable deceptive act may recover the damages actually suffered as a result of the deceptive act or $500, whichever is greater, and reasonable attorney fees. IC § 24-5-0.5-4(a). If the deceptive act was willful, the court may increase the damages to not exceed the greater of three times the actual damages or $1,000. IC § 24-5-0.5-4(a). In addition, “senior” consumers, over age 60, are entitled to treble damages. IC § 24-5-05-4(i). The Act specifically allows a victim to bring a class action against the supplier and provides that the court may award reasonable attorney fees to the prevailing party. IC § 24-5-0.5-4(b). In addition to a civil suit, the Attorney General can assert a claim under the Act and recover civil penalties and attorney fees and seek injunctive relief. IC § 24-5-0.5-4.
The Act has a variety of defenses and internal limitations. In addition, the Act has a two-year statute of limitations, which is triggered by the date of each occurrence of a deceptive act. IC § 24-5-0.5-5. And, the doctrine of fraudulent concealment can toll the statute of limitations when the defendant conceals, misleads, prevents, or hinders an inquiry.
Although no court has endorsed the application of the Act to data breach lawsuits, the Indiana Attorney General’s claim implies that the Act applies to data breaches. Application of the Act is significant for Indiana data breach victims because Indiana law does not grant consumers the right to sue a data holder for negligence following a data breach, at least according to the federal judge who presided over the Anthem data breach multi-district litigation. Order, In re Anthem, Inc. Data Breach Litig., No. 15-MD-2617 (N.D. Cal. Feb. 14, 2016).
II. The Indiana Attorney General’s Lawsuit Against Medical Informatics Engineering, Inc.
Twelve states, by respective their attorneys general, sued Medical Informatics Engineering, Inc. (“MIE”) and two MIE-related companies in December 2018, following a 2015 data breach involving the records of 3.9 million people. As background, MIE is a third-party provider that licenses a web-based electronic health record application, known as WebChart, to healthcare providers. MIE’s customers were not consumers, but healthcare providers required to comply with the HIPAA federal standards that govern the security of ePHI, including the obligation to follow what is known as the Security Rule. In a nutshell, the Security Rule requires covered entities and their business associates to protect against the unauthorized use of disclosure of ePHI. The Rule requires that these entities employ appropriate administrative, physical, and technical safeguards to maintain the confidentiality, integrity, and availability of ePHI.
On May 26, 2015, MIE and its related entities discovered that the security of ePHI had been breached. The breach began on May 7, 2015. During the following 19-day period, hackers stole 3.9 million individuals’ ePHI. Defendants began notifying affected individuals two months after the initial breach date and 50 days after the May 26, 2015 discovery date. Defendants did not conclude mailing notification letters until six months after the breach discovery date.
The complaint alleges that the defendants failed to implement basic industry-accepted data security measures to protect individual’s health information from unauthorized access. For instance, defendants set up a generic “tester” account which could be accessed using the shared password “tester” and a second account called “testing” with the shared password “testing.” The generic accounts did not require a unique user identification and password in order to gain remote access. Defendants also hired a data security consultant to try and penetrate the systems’ security. The penetration testing identified several deficiencies that were not promptly corrected.
The complaint alleges that defendants failed to implement and maintain an active security monitoring and alert system to detect and alert on anomalous conditions such as data exfiltration, abnormal administrative activities, and remote system access by unfamiliar or foreign IP addresses. The latter fact was particularly significant given the post-breach investigation revealed that two of the IP addresses from which the attack originated were in Germany.
Failing to adhere to the Minimum Necessary Standard when using or disclosing ePHI.
Again, these were failures to comply with the company’s obligations under HIPAA. However, the Indiana Deceptive Consumer Sales Act claims, if upheld by the court, would be applicable to Indiana businesses irrespective of whether they handle ePHI.
Failing to implement an adequate and effective post-breach response as the intruder continued to remove records using privileged credentials acquired through the SWL queries.
Significantly, while the lawsuit was filed at the end of 2018, these deficiencies were measured against the standards that existed at the time of the breach in 2015. Best practices continue to evolve. What constituted reasonable data security measures in the past may no longer constitute reasonable data security measures today.
Whether or not this particular claim under the Indiana Deceptive Consumer Sales Act is successful, the case serves as yet another reminder and warning that Indiana businesses that hold personally identifying information of consumers have to treat data security as a priority. This includes maintaining an active security monitoring and alert system to detect and act on anomalous conditions, such as data exfiltration, abnormal user and administrator activities, and remote system access by unfamiliar or foreign IP addresses. Adequate data security requires maintaining and implementing up to date data security policies and procedures, engaging in documented training of employees, having an incident response plan, and routinely testing and improving the plan. If you undergo penetration testing and the data security consultant identifies security framework, safeguards, or control deficiencies, you have to address them or at least set a plan in place to address them. If you are under attack, you have to employ an adequate and effective response that should include documented evidence, like a checklist, that indicates that you followed your incident response plan. Once you learn of or suspect a security incident compromising sensitive personal information has transpired, you should engage counsel to determine whether the incident rises to the level of a “breach” under applicable law and whether you have notification obligations for all of the affected individuals.
So how do you evaluate your business’s exposure based on the application of the Indiana Deceptive Consumer Sales Act to data breaches? First, ask how many consumers does your business have records on that include personally identifiable information, like credit card numbers, financial account numbers, debit card numbers, access codes, security codes, or passwords, social security numbers, and driver’s license or state identification card numbers? Estimate your risk exposure by multiplying that number by $500 per consumer and add in a hefty amount for class action plaintiff’s attorney fees. Given this number, does your business have sufficient cyber insurance policy limits? Now is the time to start hardening your cyber security defenses and increasing your cyber insurance policy limits.

References: § 24
 § 24
 § 24
 § 24
 § 24
 § 24
 § 24
 § 24
 § 24
 § 24
 § 24