Home Health & Hospice Week

No injury means no lawsuit, court says.

Stolen electronic devices are the bane of home care providers’ HIPAA compliance, but at least state courts are helping them out a bit.

When a HIPAA breach occurs but the plaintiffs cannot prove an actual injury due to the breach, many state appellate courts are ruling that the plaintiffs have no standing to file the lawsuit. After two lower courts dismissed several privacy breach cases, an appellate court has consolidated the cases and made another ruling: the Second District Illinois Appellate Court affirmed the lower courts’ decisions in the HIPAA breach lawsuits against Advocate Health and Hospitals Corporation d/b/a Advocate Medical Group, an Illinois network of affiliated physicians and hospitals (Maglio v. Advocate Health).

Two different lawsuits arose from a breach case with a scenario very familiar to many home care providers: thieves stole password-protected computers containing the protected health information of about four million former and current Advocate patients, according to a recent blog post by attorney Carolyn Metnick with Akerman. The plaintiffs alleged that Advocate’s negligence in failing to follow best practices regarding information security led to the theft of their personal data. The plaintiffs also alleged that Advocate did not secure or encrypt the computers and failed to provide timely breach notification.

“Notably, the plaintiffs did not allege that anyone had improperly accessed or used the information or that they had been the victim of identity theft or fraud,” Metnick noted. “On appeal, the plaintiffs argued that the trial courts improperly dismissed their complaints for lack of standing.”

But the appellate court shot down the plaintiffs’ appeal, calling their claims of injury “speculative,” and as such, lacking standing, Metnick said. The plaintiffs also argued that the nature of the data as medical information warrants an implicit finding of harm, but the appellate court again disagreed.

“[The plaintiffs’] claims that they face merely an increased risk of, for example, identity theft are purely speculative and conclusory, as no such identity theft has occurred to any of the plaintiffs,” the appellate court wrote. Also, the plaintiffs failed to show “a distinct and palpable injury.”