A dozen states are suing an Indiana company over a data breach that compromised information of more than 3.9 million people.
The lawsuit was filed Monday against Fort Wayne-based Medical Informatics Engineering Inc. by Indiana, Arizona, Arkansas, Florida, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina and Wisconsin.
According to the suit, hackers in 2015 stole protected health information from MIE, which provides web-based electronic health records services to medical providers. The hacked data included personal health information and identity information, such as addresses, telephone numbers and Social Security numbers.
The lawsuit alleges that MIE failed to implement industry-accepted data security measures to protect its computer system from hackers.
Minnesota Attorney General Lori Swanson said patients “expect health companies to protect the privacy of their electronic health records.”
MIE did not immediately return a request for comment Monday.
“We will always act to protect Hoosier consumers in cases such as this one,” Attorney General Hill said in a written statement about the lawsuit. “We make it our standard practice to pursue all penalties and remedies available under the law on behalf of our citizens, and we hope our proactive measures serve to motivate all companies doing business in Indiana to exercise the highest ethics and utmost diligence.”