TN AG Skrmetti Announces Multistate Settlement with Healthcare Clearinghouse Inmediata

Nashville – Attorney General Jonathan Skrmetti announced today that Tennessee and 32 other attorneys general have reached a settlement with healthcare clearinghouse Inmediata for a coding issue that exposed the protected health information (“PHI”) of approximately 1.5 million consumers for almost three years.  Under the settlement, Inmediata has agreed to overhaul its data security and breach notification practices and make a $1.4 million payment to states.  Tennessee will receive $71,273 from the settlement.

As a healthcare clearinghouse, Inmediata facilitates transactions between healthcare providers and insurers across the United States.  On January 15, 2019, Inmediata learned that PHI was available online and had been indexed by search engines.  As a result, sensitive patient information could be viewed through online searches and potentially downloaded by anyone with access to an internet search engine.  Yet, Inmediata delayed notification to impacted consumers for over three months.  Further, the notices were frequently misaddressed and were far from clear. Many consumers complained that without sufficient details or context, they had no idea why Inmediata had their data, which may have caused recipients to dismiss the notices as illegitimate.

Today’s settlement resolves allegations that Inmediata violated state consumer protection laws, breach notification laws, and HIPAA by failing to implement reasonable data security and failing to provide affected consumers with timely and complete information regarding the breach, as required by law. 

Under the settlement, Inmediata has agreed to strengthen its data security and breach notification practices in the future, including the implementation of a comprehensive information security program with specific security requirements, development of an incident response plan, and annual third-party security assessments for five years.

Indiana led the multistate investigation, assisted by the Executive Committee consisting of Connecticut, Michigan, and Tennessee, and joined by Alabama, Arizona, Arkansas, Colorado, Delaware, Georgia, Iowa, Kansas, Kentucky, Louisiana, Maryland, Massachusetts, Minnesota, Mississippi, Montana, Nebraska, New Hampshire, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, Utah, Washington, West Virginia, and Wisconsin.

###

PR23-47:  TN AG Skrmetti Announces Multistate Settlement with Healthcare Clearinghouse Inmediata