Slashdot Mirror
Federal Court: Theft of Medical Records Not an 'Imminent Danger' To Victim
chicksdaddy writes: A federal court in Texas ruled last week that a massive data breach at a hospital in that state didn't put patients at imminent risk of identity theft, even when presented with evidence that suggested stolen patient information was being used in attempted fraud and identity theft schemes. According to a post over at Digital Guardian's blog Beverly Peters was one more than 400,000 patients of St. Joseph Hospital whose information was stolen by hackers in an attack that took place between December 16 and 18, 2013.
Peters alleged that her personal information had been exposed in the breach and then disseminated in the public domain, where it was being "misused by unauthorized and unknown third parties." Specifically: Peters reported that, subsequent to the breach at St. Josephs, her Discover credit card was used to make a fraudulent purchase and that hackers had tried to infiltrate her Amazon.com account — posing as her son. Also: telemarketers were using the stolen information. Peters claimed that, after the breach, she was besieged with calls and solicitations for medical products and services companies, with telemarketers asking to speak to her and with specific family members, whose contact information was part of the record stolen from St. Joseph's.
As a result, Peters argued that she faced an "imminent injury" due to "increased risk" of future identity theft and fraud because of the breach at St. Joseph, and wished to sue the hospital for violations of the Fair Credit Reporting Act (FCRA). But the court found otherwise, ruling that Peters lacked standing to bring the case in federal court under Article III of the Constitution. That was because she hadn't been able to prove any direct damages from the attempted identity theft that occurred in the past (Discover reversed the fraudulent charge), while the threat she faced in the future was not "imminent."
As this article notes, the ruling turns on a high profile case involving government surveillance and the now-infamous FISA courts dating back to the Carter administration: Clapper v. Amnesty International USA. In that case, the U.S. Supreme Court ruled against the human rights group and a collection of lawyers and reporters in a challenge to part of the Foreign Intelligence Surveillance Act (FISA). The plaintiffs said they feared that their sources, colleagues and clients would be targets of U.S. government surveillance, and the threat would force them to take expensive security measures to keep their communications private. The High Court ruled otherwise, saying the threat of government surveillance was hypothetical, but not "certainly impending."
In his 15 page ruling (PDF), U.S. District Judge Kenneth Hoyt said the same logic applied to Peters' suit as well. "Under Clapper, Peters must at least plausibly establish a "certainly impending" or "substantial" risk that she will be victimized," Hoyt wrote. "The allegation that risk has been increased does not transform that assertion into a cognizable injury.
Peters alleged that her personal information had been exposed in the breach and then disseminated in the public domain, where it was being "misused by unauthorized and unknown third parties." Specifically: Peters reported that, subsequent to the breach at St. Josephs, her Discover credit card was used to make a fraudulent purchase and that hackers had tried to infiltrate her Amazon.com account — posing as her son. Also: telemarketers were using the stolen information. Peters claimed that, after the breach, she was besieged with calls and solicitations for medical products and services companies, with telemarketers asking to speak to her and with specific family members, whose contact information was part of the record stolen from St. Joseph's.
As a result, Peters argued that she faced an "imminent injury" due to "increased risk" of future identity theft and fraud because of the breach at St. Joseph, and wished to sue the hospital for violations of the Fair Credit Reporting Act (FCRA). But the court found otherwise, ruling that Peters lacked standing to bring the case in federal court under Article III of the Constitution. That was because she hadn't been able to prove any direct damages from the attempted identity theft that occurred in the past (Discover reversed the fraudulent charge), while the threat she faced in the future was not "imminent."
As this article notes, the ruling turns on a high profile case involving government surveillance and the now-infamous FISA courts dating back to the Carter administration: Clapper v. Amnesty International USA. In that case, the U.S. Supreme Court ruled against the human rights group and a collection of lawyers and reporters in a challenge to part of the Foreign Intelligence Surveillance Act (FISA). The plaintiffs said they feared that their sources, colleagues and clients would be targets of U.S. government surveillance, and the threat would force them to take expensive security measures to keep their communications private. The High Court ruled otherwise, saying the threat of government surveillance was hypothetical, but not "certainly impending."
In his 15 page ruling (PDF), U.S. District Judge Kenneth Hoyt said the same logic applied to Peters' suit as well. "Under Clapper, Peters must at least plausibly establish a "certainly impending" or "substantial" risk that she will be victimized," Hoyt wrote. "The allegation that risk has been increased does not transform that assertion into a cognizable injury.
Because just like a credit card number when that is lost / stolen, they can just issue you a new medical history. They can undo the fact you may have diabetes, cancer, HIV, MS, heart disease all really easily and it won't impact your life at all.
So, basically, it seems from now on that attempted murder is going to be dropped as a crime, because a bullet would actually have to hit you, or at least graze you, in order for there to be a risk of harm? This is just another sign that the corporatocracy that we live in is never again going to recognize and respect the rights of individuals that are bearing the brunt for sloppy security and an unwillingness to recognize -- or care about -- the danger that results from it.
I wonder if Judge Kenneth Hoyt would be cool with hackers openly posting all of his personal info online. After all, it's not a cognizable injury or anything.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
So, if I dropped my wallet, I wouldn't expect that there is an imminent danger that someone will take all the cash out of it and spend it?
What a clueless moron that judge is. No wonder in a state that teaches intelligent design and where half the people are functionally illiterate and marry their cousins.
If you can own I tellectual property, there ought to be a corresponding recourse to sue the telemarketers for possession of stolen goods. Even if they try to argue they didn't know it was stolen, they didn't do due diligence on the source: if you buy a new "Louis Vitton" purse from a guy in the parking lot for $20, you don't technically know its not legit, but you can't play stupid.
Courts apply the law - justice is a bit more nebulous.
Frankly, this guy seems to be using the same definition of "imminent threat" that the CIA uses when it determines who to kill/torture.
Which is of course a huge red flag that you have made a mistake. I mean really, thinking like the CIA?
excitingthingstodo.blogspot.com
Sounds like our system of law is broken. What's next?
The concept of Standing has to be the most abused notions in the legal system, especially with regards to the government.
You should not have to prove you have been specifically injured in order to make the government follow the law.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Modern criminal justice's way of explaining they're not interested in helping you.
Texas: Where it's more important to protect polluters, keep down "the gays", deny wrongfully convicted people of justice than to offer consumer/employee protections.
And, yes, I do live here and am quite familiar with Texas "justice" and its politics.
This guy is an embarrassment and a liberal ass.
Yeah...Regan nominated him. This what you get for trying to be "inclusive".
Especially stupidity.
Also, it is the home of scum like most of the Bushes and Lance Armstrong.
What a cesspool.
Isn't that the argument for warrantless wire taping, something might happen in the future? Wasn't that reason to invade Iraq, they might develop nuclear weapons...
Maybe this is saying that you can't sue for something that hasn't happened yet - and, indirectly, that the law requiring protection of confidentiality (and penalizing failure) has no teeth, and that the limits against abusive overreach of law are allowing an end-run around the general intent.
Let's say you had a workman at your house, and they left the garage door unlocked when they were finished. If you come home and everything is fine, then there is no cause for legal action. If you come home and your house has been robbed, then first it's the robber's criminal act, and then maybe there's a civil action by your insurance company to get money from the workman's insurance company.
The hospital is seen as the *victim* of a theft, just as if a doctor's or psychiatrist's office were broken into for drugs and some records were stolen, rather than a *culprit* for "failing to maintain HIPAA confidentiality". YOU have to go after each person who does something illicit with the information; each marketer, each fraud instance, each problem, is individual. And since each of them is small individually, it's YOUR burden to chase them as a civil matter rather than a criminal matter that would get you some help from society (through the police agencies).
If a breach happens, just change your medical history.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Meanwhile the people engaged in the Obamacare suit have 'standing'...
Our courts are rotten to the core.
"Hasn't happened yet"? Are you claiming she hasn't been "besieged with calls and solicitations for medical products and services companies"?
To hell with doxxing the judge, start flooding him with direct calls now that he has legally agreed that such actions do not constitute a cognizable injury.
This is government spooks wanting to get at something that they can't get at because of HIPAA, and they are now used to just stealing and taking.
Courts are for the citizens not government agents.
Remember that Texas is 99.999% Republican.
Don't expect courts in this state to favor patient rights over the "rights" of medical conglomerates.
So, suddenly when the government is on the line the Constitution is useful for something more than toilet paper? Got it.
It's amazing how so many judges lack sound judgement, which, by definition, should be a basic requirement for the job....
Do you have ESP?
It isn't just the calls...
Her discover card had fruadulant charges and her Amazon account had a social engineering attempt. She is so far beyond just phone calls.
This is a sig. This is only a sig. Had this been an actual sig you would have been informed where to tune for more sigs.
Generally people do not understand about personal data until it bites them in the butt. If his data and his families data gets highlighted in those records on the net. Bet he will think differently very fast. Perhaps he needs to understand the personal injury before he can make good decisions.
Until is more expensive for people that make these decisions and corporations that fail on so many levels of bureaucracy, no changes will be made that have an impact.
Throw the bum out ... no, wait: Appointed Forever Bar and Grille Singers
If anybody has any doubt as to how fast this information is being exploited, my information was recently compromised by my insurance company, and within three days of a surgical procedure I had bogus calls trying to bill me for equipment that I never received, requested, nor had the doctor requested. One called me up and say is this Mr Doe? I said "Yes, with whom am I speaking?" He then went on that I needed to give them my information and asked for my zip code.. all of this with a heavy Indian accent. I told him to fuck off and hung up.
A week later a snail mail came in from a different 'company' which had a real company's letterhead with bogus contact information asking me the same sorts of things. It had an 877 number that I traced to what appears to be a medical student in India. I'm considering notifying the 'real' company about it.
What a fucking joke. These assholes need to be hit with a drone strike.
So what do you know? And if you don't know these things, why even mention them? What's this, a scary story about cyber bogeymen?
You guys obliquely or not so obliquely calling for doxing of a Federal Judge are pretty brave, I must say.
But maybe you'll find out definitively if a U.S. Marshall Service no-knock warrant results in someone like Raylan Givens showing up to execute it, or whether that's just in Harlan County.
Regardless, I'm sure whatever jail you end up in will definitely have someone who resembles Boyd Crowder.
"Your honor, the plaintiff's files are now complete safe. They're in no danger. Unless the new Jaguar that is parked just outside your office in the no park zone. The one for which the keys have been put .... right ... here"
There really seems to be no logical/moral ideas behind these decisions.
... because it is another hammer-strike on the chisel that's helping shape the body of evidence required to successfully try breach cases like this.
The plaintiff has no standing because 1.) no identity theft actually occurred, 2.) there is no strong indicator that identity theft will occur.
As litigants sharpen the evidentiary needle, courts are going to be boxed in to a decision just as soon as a victim meets criteria 1.) and 2.).
It'not, "if," it's "when."
It little behooves the best of us to comment on the rest of us.
The court did not say she was wrong, it said she went to the wrong courthouse.
The difference in this case as I understand it is that the hospital was legally required to lock that door then they failed to properly secure the door which resulted in the theft of sensitive information. In your example there is no such burden placed on the workmen. They are not required by law to ensure the safety of the homes that they work at unlike the hospital. A better example would be to compare the hospital to a bank. If a bank is robbed and all of there customer's money is stolen is the bank not responsible for the damages caused to those customers for failing to properly secure their money? I would think that they would be, and make no mistake, having such confidential data stolen can be just as devastating if your credit rating gets nailed or your accounts get drained. As far as standing I don't think there is a question that there are damages here. The time and effort alone to rectify all of the locked accounts, get cards reissued, and reverse charges is plenty of damage to justify a civil suite.
"There are lies, there are damn lies, and there are statistics"
The judge just figures out who has the least money and then rules against them.
Although it is alleged that St. Joseph's failures "proximately caused" these injuries, the allegation is conclusory and fails to account for the sufficient break in causation caused by opportunistic third parties. The injuries, to the extent that they meet the first prong, are "the result of the independent action of a third party" and therefore not cognizable under Article III.
1) Company leaks your data
2) Third parties abuse your data
3) You don't have standing to sue company, because you've been harmed by third parties.
Who else would have standing to sue expect for the people whose data is being protected? This is basically saying nobody has standing and the law is null and void. This judge should rule the Snowden trial, if there ever is one. He'd dismiss all charges because the US government would lack standing, they haven't been harmed by Snowden's actions only the actions of independent third parties acting on his information. That's a clear break in causation, don't you agree?
Live today, because you never know what tomorrow brings
Hold on let me steal that guy's medical record. OH! Says here he's allergic to peanuts. Just slip a little in his lunch and........
This from the state that brings you the courts that all Patent Trolls file in and rehab for Affluenza.
Would you expect less? Texas, we're not Florida, but we're catching up.
Have gnu, will travel.
who enrolled in insurance policies through HealthCare.gov received erroneous tax information from the government, and were urged on Friday to hold off on filing tax returns until the error could be corrected.
The bank is of course Federally backed so you get your money back anyway. The stolen medical information that would allow someone to commit identity theft as well as other crimes while posing as the medical record holder.
So really, I'd rather someone rob my bank then steal my identity. Losing your money doesn't open you up to potential criminal charges the same way fraud could.
That's all fine and dandy, until you realize that we are jailing crackers who expose user/password databases.
By your logic, we should not do so. We should only persecute the crackers if its proven that a user's login is used in a way that causes damages. While I agree with this logic, the fact that we don't demonstrates that the law is immune to both our logic and their own.
The hospital **will** be facing fines for the breach, HIPAA violations are expensive. Hospitals have been cutting IT staff in recent years as a penny-smart/pound-foolish cost-saving measure, wonder if this will show Franciscan Healthcare how stupid that is.
"Think about how stupid the average person is. Now, realise that half of them are dumber than that." - George Carlin
The difference in this case as I understand it is that the hospital was legally required to lock that door then they failed to properly secure the door which resulted in the theft of sensitive information.
From my understanding of this case, that's a different issue. You're talking about the concept of negligence: that you were obligated to or should do something, but you didn't.
Maybe the hospital did everything they should do, but thieves broke in anyway. That would be a whole other investigation.
If a bank is robbed and all of there customer's money is stolen is the bank not responsible for the damages caused to those customers for failing to properly secure their money?
Yes and no. The bank is obligated to pay back the money the customers had in their accounts with the bank. But that's it.
What this case is about is that the woman wants the bank to also pay for the damages caused by the money stolen from the bank by the robbers either directly (hackers trying to get to her CC) or indirectly (marketers using her info)
Think of it this way: suppose I promise to hold on to your gun for you. Somebody broke in and stole that gun. They used that gun (your gun) to shoot you. Am I guilty of murdering you?
nope, the bank is not responsible. The FDIC will cover some losses because the bank bought insurance (because not having it means fewer customers), but above that you're SOL unless the thief is caught and the money is returned.
What this case is about is that the woman wants the bank to also pay for the damages caused by...
She wants the hospital to be liable, not the bank.
Open call to doxx the judge? Anonymous, are you listening?
And then if the gov't catches the hackers, they can just say, hey there was no harm!!! He said so himself!
I grieve for the lawyer who has a geek for a client.
The accidental exposure of medical records and the like can potentially be quite damaging, of course. But the harm to any particular individual or institution can be hard to measure, at least in the beginning.
The moment you conspire to actually make use of such personal information to harass or intimate a federal judge you are open to conviction on the felony charge.
Does anyone know about a follow up to the Virginia hospital hack of a few years ago? The hack that left at brazen ransom note? It seems the story and the perpetrator have disappeared from the public spotlight. Anyone have any follow up info??
But the calls, if one considers a huge volume of calls as 'harassment' as most non-public people do, are the only unremedied harm she has suffered. If this judge has freely stated that he believes a large volume of commercial calls are not 'harm' then he's given permission for being on the receiving end.
We should only persecute the crackers if its proven that a user's login is used in a way that causes damages.
We should prosecute them too.
"Those who make peaceful revolution impossible, make violent revolution inevitable." - JFK