Skip to main content
  • Call
    Contact Us

    TOLL FREE: 1-866-9-NO-SCAM

     
  • File Complaint
Logo
  • Home
  • Meet the Attorney General
    • Attorney General James Uthmeier
    • Official Photo
  • About the Office
    • Departments
      • AG Opinions
      • Antitrust
      • Civil Legal Services
      • Civil Litigation
      • Consumer Protection
      • Criminal Appeals
      • Litigation Services
      • Medicaid Fraud
      • Parental Rights
      • Solicitor General
      • Statewide Prosecution
    • Programs
      • Back the Blue
      • Be a Florida Hero
      • Consumer Alerts
      • Criminal Justice Programs
      • Military and Veterans Assistance Program
      • Seniors vs. Crime
      • Cold Case Investigations Unit
    • Services
      • Civil Rights
      • Human Trafficking Prevention and Awareness
      • Identity Theft
      • Lemon Law
      • Office of Inspector General
      • Open Government
      • Victims Services
  • Contact Us
    • Addresses & Phone Numbers
    • File A Complaint
    • General Inquiries
    • Media Contact
Logo
  • Home
  • Meet the Attorney General
    • Attorney General James Uthmeier
    • Official Photo
  • About the Office
    • Departments
      • AG Opinions
      • Antitrust
      • Civil Legal Services
      • Civil Litigation
      • Consumer Protection
      • Criminal Appeals
      • Litigation Services
      • Medicaid Fraud
      • Parental Rights
      • Solicitor General
      • Statewide Prosecution
    • Programs
      • Back the Blue
      • Be a Florida Hero
      • Consumer Alerts
      • Criminal Justice Programs
      • Military and Veterans Assistance Program
      • Seniors vs. Crime
      • Cold Case Investigations Unit
    • Services
      • Civil Rights
      • Human Trafficking Prevention and Awareness
      • Identity Theft
      • Lemon Law
      • Office of Inspector General
      • Open Government
      • Victims Services
  • Contact Us
    • Addresses & Phone Numbers
    • File A Complaint
    • General Inquiries
    • Media Contact

Breadcrumb

  1. Home
  2. News Releases
  3. Ag Announces Multistate Hipaa Related Data Breach Agreement

AG Announces Multistate HIPAA-Related Data Breach Agreement

View PDF
Release Date
May 23, 2019
Contact
Kylie Mason
Phone
850-245-0150

Nation’s first-ever multistate


TALLAHASSEE, Fla.—Attorney General Ashley Moody today announced an agreement reached in the nation’s first-ever multistate lawsuit filed in a federal court involving a Health Insurance Portability and Accountability Act data breach. The 16-state agreement comes following a lawsuit filed in December 2018 in federal court in Indiana against Medical Informatics Engineering, Inc., a web-based electronic health records company. The company provides patient portal and personal health records services to healthcare providers that enable patients to access and manage their electronic health records. In 2015, the company allegedly sustained a data breach compromising the data of more than 3.9 million people. The proposed consent judgment, pending court approval, resolves allegations that MIE violated provisions of HIPAA, as well as the Florida Information Protection Act and the Florida Deceptive and Unfair Trade Practices Act.

Attorney General Ashley Moody said, “Consumers have the right to have their most private health details protected. Companies that are entrusted with individual’s medical records and other private information must take serious precautions to keep information secure from hackers.”

In May 2015, the hackers allegedly infiltrated one of MIE’s servers containing names, mailing addresses, usernames, passwords and sensitive health information. The hackers allegedly stole the electronic Protected Health Information of more than 3.9 million people, including more than 112,000 records belonging to Floridians. According to the investigation, the hackers exploited several vulnerabilities at MIE at the time of the data breach, including poor password and security management protocols.

Under the terms of the consent judgment, MIE agreed to implement and maintain:

· An information security program and a Security Incident and Event Monitoring solution to detect and respond to malicious attacks;
· Data loss prevention technology to detect and prevent unauthorized data exfiltration;
· Password policies and procedures requiring the use of strong, complex passwords;
· Multi-factor authentication procedures when remotely accessing its systems that store or permit access to ePHI; and
· Controls on the creation of accounts with access to ePHI.

As part of the agreement, MIE will also pay nearly one million dollars to the states that filed the federal lawsuit. The other states participating in the agreement are Arizona, Arkansas, Connecticut, Indiana, Iowa, Kansas, Kentucky, Louisiana, Michigan, Minnesota, Nebraska, North Carolina, Tennessee, West Virginia and Wisconsin.

To view the amended complaint, click here. To view the consent judgment, click here.

Resources

  • AG Opinions
  • Annual Regulatory Plan
  • Consumer Protection
  • Doing Business with the Office
  • FAQ
  • Florida Digital Bill of Rights Annual Enforcement Report
  • Opioid Settlements
  • Statement of Agency Organization and Operation

Quick Links

  • Consumer Alerts
  • Military and Veterans Assistance Program
  • Open Government
  • Dose of Reality Florida
  • Request for Proposal for Professional Legal Services – PFAS
  • Request for Proposal for Professional Legal Services – Polychlorinated biphenyls
  • Request for Proposal for Professional Legal Services – Insulin
  • Crime Prevention Summit

 

  • Employment
  • File a Complaint
  • Human Trafficking Summit
  • Victim Services
  • Dozier Claims
  • Nicotine Dispensing Device Directory
Logo

Office of the Attorney General
State of Florida
PL-01, The Capitol
Tallahassee, FL 32399-1050

Privacy Policy | © 2025 State of Florida. All rights reserved.