USDC IN/ND Case 3:18-Cv-00969-RLM-MGG Document 57 Filed 05/23/19 Page 1 of 83
Total Page:16
File Type:pdf, Size:1020Kb
USDC IN/ND case 3:18-cv-00969-RLM-MGG document 57 filed 05/23/19 page 1 of 83 1 Douglas S. Swetnam (IN State Bar #15860-49) Section Chief – Data Privacy & ID Theft Unit 2 Office of Attorney General Curtis Hill Jr. 3 302 W. Washington St., 5th Floor Indianapolis, IN 46204 4 Email: [email protected] Telephone: (317) 232-6294 5 6 Michael A. Eades (IN State Bar #31015-49) Deputy Attorney General 7 Office of Attorney General Curtis Hill, Jr. 302 W. Washington St., 5th Floor 8 Indianapolis, IN 46204 9 Email: [email protected] Telephone: (317) 234-6681 10 John C. Gray (Pro Hac Vice) 11 Assistant Attorney General 12 Office of Attorney General Mark Brnovich 2005 N. Central Ave. 13 Phoenix, AZ 85004 Email: [email protected] 14 Telephone: (602) 542-7753 15 Attorney for Plaintiff State of Arizona 16 Peggy Johnson (Pro Hac Vice) Assistant Attorney General 17 Office of Attorney General Leslie Rutledge 18 323 Center St., Suite 200 Little Rock, AR 72201 19 Email: [email protected] Telephone: (501) 682-8062 20 Attorney for Plaintiff State of Arkansas 21 Michele Lucan (Pro Hac Vice) 22 Assistant Attorney General Office of Attorney General William Tong 23 110 Sherman Street 24 Hartford, CT 06105 Email: [email protected] 25 Telephone: (860) 808-5440 Attorney for Plaintiff State of Connecticut 26 27 28 Indiana et. al. v. Medical Informatics Engineering, Inc. et al. Complaint page 1 of 83 USDC IN/ND case 3:18-cv-00969-RLM-MGG document 57 filed 05/23/19 page 2 of 83 1 Patrice Malloy (Pro Hac Vice) Bureau Chief, Multistate and Privacy Bureau 2 Florida Office of the Attorney General 3 110 SE 6th Street Fort Lauderdale, FL 33301 4 (954) 712-4669 [email protected] 5 6 Diane Oates (Pro Hac Vice) Assistant Attorney General 7 Florida Office of the Attorney General 110 Southeast 6th Street 8 Fort Lauderdale, FL 33301 9 Email: [email protected] Telephone: (954) 712-4603 10 Attorneys for Plaintiff State of Florida 11 William Pearson (Pro Hac Vice) 12 Assistant Attorney General Office of Attorney General Tom Miller 13 1305 E. Walnut, 2nd Floor Des Moines, IA 50319 14 Email: [email protected] 15 Telephone: (515) 281-3731 Attorney for Plaintiff State of Iowa 16 Sarah Dietz (Pro Hac Vice) 17 Assistant Attorney General 18 Office of Attorney General Derek Schmidt 120 S.W. 10th Ave., 2nd Floor 19 Topeka, KS 66612 Email: [email protected] 20 Telephone: (785) 368-6204 21 Attorney for Plaintiff State of Kansas 22 Kevin R. Winstead (Pro Hac Vice) Assistant Attorney General 23 Office of Attorney General Andy Beshear 24 1024 Capital Center Drive Frankfort, KY 40601 25 Email: [email protected] Telephone: (502) 696-5389 26 Attorney for Plaintiff Commonwealth of Kentucky 27 28 Indiana et. al. v. Medical Informatics Engineering, Inc. et al. Complaint page 2 of 83 USDC IN/ND case 3:18-cv-00969-RLM-MGG document 57 filed 05/23/19 page 3 of 83 1 Alberto A. De Puy (Pro Hac Vice) Assistant Attorney General 2 Office of Attorney General Jeff Landry 3 1885 N. Third St. Baton Rouge, LA 70802 4 Email: [email protected] Telephone: (225) 326-6471 5 6 L. Christopher Styron (Pro Hac Vice) Assistant Attorney General 7 Office of Attorney General Jeff Landry 1885 N. Third St. 8 Baton Rouge, LA 70802 9 Email: [email protected] Telephone: (225) 326-6400 10 Attorneys for Plaintiff State of Louisiana 11 Kathy Fitzgerald (Pro Hac Vice) 12 Assistant Attorney General Department of Attorney General Dana Nessel 13 Corporate Oversight Division 525 W. Ottawa St., 5th Floor 14 Lansing, MI 48933 15 Email: [email protected] Telephone: (517) 335-7632 16 Attorney for Plaintiff State of Michigan 17 Jason T. Pleggenkuhle (Pro Hac Vice) 18 Assistant Attorney General Office of Attorney General Keith Ellison 19 Bremer Tower, Suite 1200 445 Minnesota St. 20 St. Paul, MN 55101-2130 21 Email: [email protected] Telephone: (651) 757-1147 22 Attorney for Plaintiff State of Minnesota 23 Daniel J. Birdsall (Pro Hac Vice) 24 Assistant Attorneys General Office of Attorney General Doug Peterson 25 2115 State Capitol PO Box 98920 26 Lincoln, NE 68509 27 Email: [email protected] Telephone: (402) 471-1279 28 Attorney for Plaintiff State of Nebraska Indiana et. al. v. Medical Informatics Engineering, Inc. et al. Complaint page 3 of 83 USDC IN/ND case 3:18-cv-00969-RLM-MGG document 57 filed 05/23/19 page 4 of 83 1 Kimberley A. D’Arruda (Pro Hac Vice) Special Deputy Attorney General 2 North Carolina Department of Justice 3 Office of Attorney General Joshua H. Stein P.O. Box 629 4 Raleigh, NC 27602-0629 Email: [email protected] 5 Telephone: (919) 716-6013 6 Attorney for Plaintiff State of North Carolina 7 Carolyn U. Smith (Pro Hac Vice) Senior Assistant Attorney General 8 Office of the Attorney General and Reporter Herbert H. Slatery III 9 P.O. Box 20207 Nashville, TN 37202-0207 10 Email: [email protected] Telephone: (615) 532-2578 11 Attorney for Plaintiff State of Tennessee 12 Tanya L. Godfrey (Pro Hac Vice) 13 Assistant Attorney General Office of the West Virginia Attorney General Patrick Morrisey 14 269 Aikens Center 15 Martinsburg, WV 25404 Email: [email protected] 16 Telephone: (304) 267-0239 Attorney for Plaintiff State of West Virginia 17 18 R. Duane Harlow (Pro Hac Vice) Assistant Attorney General 19 Director, Consumer Protection and Antitrust Unit Wisconsin Department of Justice 20 Office of Attorney General Josh Kaul 21 17 W. Main St., P.O. Box 7857 Madison, WI 53707-7857 22 Email: [email protected] Telephone: (608) 266-2950 23 Attorney for Plaintiff State of Wisconsin 24 25 26 27 28 Indiana et. al. v. Medical Informatics Engineering, Inc. et al. Complaint page 4 of 83 USDC IN/ND case 3:18-cv-00969-RLM-MGG document 57 filed 05/23/19 page 5 of 83 1 IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF INDIANA 2 SOUTH BEND DIVISION 3 The States of Arizona; Arkansas; Connecticut; Case No.:3:18-cv-969-RLM-MGG 4 Florida; Indiana; Iowa; Kansas; Kentucky; Louisiana; Michigan; Minnesota; Nebraska; 5 North Carolina; Tennessee; West Virginia; and 6 Wisconsin, 7 Plaintiffs; 8 v. 9 Medical Informatics Engineering, Inc. d/b/a 10 Enterprise Health, LLC and K& L Holdings, and NoMoreClipboard, LLC , 11 Defendants. 12 13 AMENDED COMPLAINT 14 Plaintiffs, the states of Arizona, Arkansas, Connecticut, Florida, Indiana, Iowa, Kansas, 15 Kentucky, Louisiana, Michigan, Minnesota, Nebraska, North Carolina, Tennessee, West 16 17 Virginia, and Wisconsin (collectively “Plaintiff States”), for their complaint against Defendants 18 Medical Informatics Engineering, Inc., (“MIE”) operating as Enterprise Health, LLC and K&L 19 Holdings, and NoMoreClipboard, LLC, (“NMC” together with MIE “Defendants”), allege: 20 SUMMARY OF THE CASE 21 22 1. Intermittently between May 7, 2015 and May 26, 2015, unauthorized persons 23 (“hackers”) infiltrated and accessed the inadequately protected computer systems of Defendants. 24 During this time, the hackers were able to access and exfiltrate the electronic Protected Health 25 26 Information (“ePHI”), as defined by 45 C.F.R. § 160.103, of 3.9 million individuals, whose PHI 27 was contained in an electronic medical record stored in Defendants’ computer systems. Such 28 Indiana et. al. v. Medical Informatics Engineering, Inc. et al. Complaint page 5 of 83 USDC IN/ND case 3:18-cv-00969-RLM-MGG document 57 filed 05/23/19 page 6 of 83 1 personal information obtained by the hackers included names, telephone numbers, mailing 2 addresses, usernames, hashed passwords, security questions and answers, spousal information 3 (names and potentially dates of birth), email addresses, dates of birth, and Social Security 4 Numbers. The health information obtained by the hackers included lab results, health insurance 5 6 policy information, diagnosis, disability codes, doctors’ names, medical conditions, and 7 children’s name and birth statistics. 8 2. In fostering a security framework that allowed such an incident to occur, 9 Defendants failed to take adequate and reasonable measures to ensure their computer systems 10 were protected, failed to take reasonably available steps to prevent the breaches, failed to 11 12 disclose material facts regarding the inadequacy of their computer systems and security 13 procedures to properly safeguard patients’ personal health information, failed to honor their 14 promises and representations that patients’ personal health information would be protected, and 15 failed to provide timely and adequate notice of the incident, which caused significant harm to 16 consumers across the United States. 17 18 3. Defendants’ actions resulted in the violation of the state consumer protection, data 19 breach, personal information protection laws and federal HIPAA statutes, as more fully outlined 20 below. Plaintiffs seek to enforce said laws by bringing this action. 21 4. This action is brought, in their representative and individual capacities as 22 provided by state and federal law, by the attorneys general of Arizona, Arkansas, Connecticut, 23 24 Florida, Indiana, Iowa, Kansas, Kentucky, Louisiana, Michigan, Minnesota, Nebraska, North 25 Carolina, Tennessee, West Virginia, and Wisconsin (collectively the “Attorneys General”). The 26 plaintiffs identified in the paragraph are also referred to collectively as the “Plaintiff States.” 27 28 Indiana et. al. v. Medical Informatics Engineering, Inc. et al. Complaint page 6 of 83 USDC IN/ND case 3:18-cv-00969-RLM-MGG document 57 filed 05/23/19 page 7 of 83 1 5.