Minnesota sues Indiana firm, blames lax security after hackers steal health patient data

Minnesota Attorney General Lori Swanson filed a lawsuit Monday against an Indiana medical services company after hackers stole more than 8,000 health records of Minnesota patients in 2015.

In the federal court filing, Swanson alleged that Medical Informatics Engineering violated Minnesota’s consumer protection and data privacy laws when they failed to use “basic” security measures to protect their web-based electronic health records services from hackers.

“Patients expect health companies to protect the privacy of their electronic health records. This company did not do so,”  Swanson said in a prepared statement.

The hackers breached the system in 2015 using the company’s own “tester” account with the shared user password, “tester.” The company also failed to encrypt the private information stored on its system, which would have made the stolen data unusable.

The lawsuit seeks injunctive relief, civil penalties and restitution for the affected patients with 11 other states joining Minnesota in the lawsuit against the company.

Medical Informatics Engineering also failed to inform patients in a timely manner, as required by Minnesota law, by taking up to six months to complete the notification process.

The company was also notified by an outside computer vendor in 2015 that its system was vulnerable to hacking and failed to address the security concerns.

The information stolen included:

• Personal health information: Current diagnoses, lab results and health insurance information.
• Personal identifiable information: Addresses, telephone numbers, date of birth and Social Security numbers.

Medical Informatics Engineering provides online health records services to medical providers with the programs WebChart and NoMoreClipboard.

As part of the Affordable Care Act, health care providers were encouraged to implement electronic health records, which led to an increase in third-party health service vendors, like Medical Informatics Engineering, and led to an increase in their use by physicians.