Attorneys General from 12 U.S. states have filed a lawsuit against Medical Informatics Engineering (MIE) over a data breach the company experienced in 2015.
MIE, previously known as Enterprise Health, and its subsidiary NoMoreClipboard’s products allow healthcare providers to transmit and share information. During the summer of 2015, MIE was forced in notify customers that servers used by its WebChart electronic health record (EHR) solution had been breached, leaking the details of 3.9 million individuals.
Details included in the breach included the names, dates of birth, social security numbers, health insurance details, medical information, phone numbers, addresses, usernames and hashed passwords, email addresses, and security questions and answers.
Attorneys General from 12 states have responded to the breach by filing a lawsuit against MIE – the first ever multistate data breach lawsuit related to the Health Insurance Portability and Accountability Act (HIPAA).
AGs representing Indiana, Arizona, Arkansas, Florida, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina, and Indiana have filed suit against MIE, which is headquartered in Indiana.
Authorities state that MIE failed to implement basic cybersecurity protections, did not have security mechanisms established for preventing the exploitation of vulnerabilities in its systems, failed to encrypt sensitive patient personal and medical data, and had an insufficient and ineffective response to the data breach.
Security experts recommend using trusted CIS Benchmark secure configuration guidance to harden systems against vulnerabilities and attack. This eliminates known vulnerabilities and strengthens cybersecurity defenses by application expert-derived configuration policies to your IT environment.
Follow this link to learn more information on the recommended hardened services settings for HIPAA.
Read this article on SecurityWeek.com