Home Health & Hospice Week

Class action suit based on laptop theft results in serious damages.

A failure to encrypt PHI on your laptops might bring more than penalties from HHS. It could result in a pricey class action lawsuit, even if no actual harm resulted from the theft.

Case in point: Health insurer AvMed Inc. recently entered into a settlement agreement through the U.S. District Court for the Southern District of Florida, in which the company has agreed to pay $3 million to resolve the allegations in a data-breach class action lawsuit.

Background: In December 2009, three un-encrypted laptops were stolen from AvMed’s corporate offices in Gainesville, Fla., wrote Los Angeles-based attorney Claire Readhead of Alston & Bird in a recent analysis of the case in the firm’s privacy and security blog. And two of those laptops contained “sensitive information,” including the protected health information (PHI) and Social Security numbers of 1.2 million AvMed members.

Members and other plaintiffs filed a class action lawsuit, claiming that AvMed failed to en-crypt and safeguard the stolen laptop computers, which resulted in the exposure of the members’ personal information, Readhead reported. AvMed filed a motion to dismiss, arguing that courts across the country have turned down data breach cases that failed to allege the lost or stolen data had been misused in a way that inflicts a compensable injury or damage to the plaintiff.

How The Settlement Payout Breaks Down

But the Florida court disagreed with Av-Med’s argument. According to a March 4 Health Law Rx Blog posting by healthcare attorney Eliza-beth F. Hodge with Akerman in Tampa, Fla., Av-Med settled the case and agreed to pay $3 million to a Settlement Fund, which will pay out:

• Up to $30 per AvMed member whose personal information was on the stolen laptops but who did not suffer identity theft. These members are part of the “Premium Overpayment Settlement Class,” and the relief reimburses the members for the portion of premiums that they contended AvMed should have spent on adequate data protection.

• The reimbursable amount of any proven actual, monetary loss that occurred to each member as a result of the breach. This group of AvMed members is the “Identity Theft Settlement Class.”

• $750,000 in attorneys’ fees and costs for the plaintiffs’ class.

• $10,000 as an incentive award, split evenly among the class representatives for their efforts in serving as class representatives.

• The costs of sending notices to the settlement classes, as well as all costs of settlement ad-ministration.

Influence On Future Cases

What sets this apart from other data breach settlements is that in this case, the “plaintiffs who have not suffered identity theft as a result of the breach may nevertheless collect from the Settlement Fund,” Readhead explained. “Plaintiffs who did not suffer identity theft claimed they were injured by overpaying an insurance premium which was supposed to safeguard data.”

What this means: “This settlement agreement demonstrates that healthcare providers, health plans, and their business associates may have increased exposure for damages in data breach lawsuits, even when plaintiffs cannot establish actual damages as a result of a breach,” Hodge warned. “This settlement likely will serve as a model for future data security class action claims.”

Beware that the AvMed settlement “marks a change in the traditional view of data breach damages,” Readhead cautioned. So you should carefully review your insurance policies as well as your data security practices to mitigate your exposure.

Beware  ‘Unjust Enrichment’ Issue

Another issue in this lawsuit is the “unjust enrichment” theory. This is when plaintiffs claim that the insurer or provider should have used a portion of their health insurance premiums or medical care payments to improve data security.

“Plaintiffs have pleaded this unjust enrichment theory in other data breach cases in Florida courts without success,” Hodge noted. “Time will tell if the AvMed settlement breathes new life into unjust enrichment and other novel data breach theories.” v

Note: To view the entire settlement agreement, go to www.akerman.com/documents/AvMedDataBreachSettlementAgreement.pdf.