Georgia Supreme Court: Are data breach victims entitled to damages?

guest · Aug 21, 2019

Georgia Supreme Court: Are data breach victims entitled to damages?
State’s highest court considers precedent-setting case
August 20, 2019
https://www.ajc.com/news/local/dark...ant-georgia-precedent/OodqLx3yaTGZwinAHyGO1O/

In the spring of 2016, a cyber thief calling himself the “Dark Overlord” hacked into the databases of a Clarke County medical clinic and emerged with the personal information of an estimated 200,000 patients.

The Athens Orthopedic Clinic refused to pay the hacker’s ransom and advised current and former patients to set up anti-fraud protections. Now a lawsuit filed by three of those patients — demanding that the clinic pay damages — could set a precedent in Georgia, where reports of data breaches have been soaring.

On Tuesday, the Georgia Supreme Court heard arguments that revolved around a key question: must a data breach victim suffer actual financial loss to be compensated under the law?
Their answer could have broad ramifications. Atlanta-based Equifax, Georgia Tech and the Georgia Secretary of State’s Office are just some of the places where breaches have exposed the data of millions of people.
Click to expand...

mirimir · Aug 21, 2019

The Athens Orthopedic Clinic refused to pay the hacker’s ransom ...
Click to expand...

That's rather beside the point. I mean, you'd trust "Dark Overlord" to actually delete the data?

Anyway, if potential losses become recoverable, using PII in online services will be lots riskier.

Not that it'd be a bad thing.

guest · Dec 25, 2019

Georgia Supreme Court resuscitates patient lawsuit against Athens Orthopedic Clinic
(PDF): https://www.gasupreme.us/wp-content/uploads/2019/12/s19g0007.pdf

When a criminal steals consumers’ sensitive personal data, what do those consumers have to plead against the allegedly negligent business from whom the data was stolen to show a legally cognizable injury under Georgia tort law?
The plaintiffs here, current or former patients of the defendant medical clinic, brought a putative class action after the clinic informed them that a hacker had stolen their personal data from the clinic.

We conclude that the injury the plaintiffs allege that they have suffered is legally cognizable. Because the Court of Appeals held otherwise in affirming dismissal of the plaintiffs’ negligence claims, we reverse that holding.
Click to expand...

guest · Dec 25, 2019

mood said: ↑

Georgia Supreme Court resuscitates patient lawsuit against Athens Orthopedic Clinic
(PDF): https://www.gasupreme.us/wp-content/uploads/2019/12/s19g0007.pdf
Click to expand...

Ga. high court’s ruling on 200K-victim cyber attack could set precedent
December 25, 2019
https://www.ajc.com/news/crime--law...k-could-set-precedent/2GaxKtrePkQDEI2lIuCHMJ/

A ruling from Georgia’s highest court this week could set a precedent that determines recourse for victims of cyber attacks, an ever-growing problem.

The Georgia Supreme Court on Monday ruled that the victims of a Athens-area medical clinic whose computer databases — invaded by anonymous hacking group “The Dark Overlord” — can sue the clinic. The unanimous ruling reverses the Georgia Court of Appeals decision to throw the case out.
Justices found that even the threat of future harm to a data breach victim is enough to be compensated for under the law, which could set statewide precedent in these types of crimes.

Justice Nels Peterson wrote in the Athens clinic opinion that the law is behind the prevalence of cyber crime and it may be up to another branch of government to fix.
Click to expand...

guest · Sep 28, 2020

Orthopedic Clinic Settles with HHS OCR for $1.5 Million over Claims of Systemic HIPAA Noncompliance
September 25, 2020
https://www.natlawreview.com/articl...hhs-ocr-15-million-over-claims-systemic-hipaa

The US Department of Health and Human Services’ Office for Civil Rights (“OCR”) recently announced a settlement with Georgia-based Athens Orthopedic Clinic PA (the “Clinic”) to resolve multiple alleged violations of the Privacy and Security Rules under the Health Insurance Portability and Accountability Act (“HIPAA”).

Under the terms of the settlement, the Clinic agreed to pay $1.5 million to OCR and to adopt a corrective action plan to settle potential violations of the Privacy and Security Rules under HIPAA. The Clinic provides orthopedic services to approximately 138,000 patients annually.
According to the OCR press release, OCR’s investigation discovered longstanding, systemic noncompliance by the Clinic with the HIPAA Privacy and Security Rules, including failures to conduct risk analyses, implement risk management and audit controls, [...]
Click to expand...

In addition to the financial penalty, the Clinic agreed to a corrective action plan with a term of two years and covering the aspects of noncompliance discovered during OCR’s investigation. The corrective action plan includes a requirement to obtain OCR’s prior approval of policies, analyses and training and to submit annual reports to OCR. In settling the matter, the Clinic made no admission of liability.

“Hacking is the number one source of large health care data breaches. Health care providers that fail to follow the HIPAA Security Rule make their patients’ health data a tempting target for hackers,” said OCR Director Roger Severino.
Click to expand...

...Athens Orthopedic Clinic is is still facing the lawsuit from patients (Georgia Supreme Court)

Log in or Sign up

Georgia Supreme Court: Are data breach victims entitled to damages?

guest Guest

mirimir Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

Georgia Supreme Court: Are data breach victims entitled to damages?

guest Guest

mirimir Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches