Antitrust Law Daily Wrap Up, PRIVACY NEWS: LabMD's data security efforts on trial in FTC action, (May 28, 2014)

By Jeffrey May, J.D.

Last week, FTC Chief Administrative Law Judge D. Michael Chappell commenced a hearing to determine whether a now-defunct medical testing laboratory engaged in unfair acts or practices in violation of Sec. 5 of the FTC Act by failing to prevent the unauthorized disclosure of consumer information from its computer systems. The hearing is expected to continue through at least the end of this week (In the Matter of LabMD, Inc., FTC Dkt. 9357, File No. 102 3099).

The FTC complaint arose out of two security breach incidents experienced by LabMD, Inc. The agency alleged that, as a result of data security failures, unauthorized third parties obtained consumer information from the company’s computer systems via peer-to-peer file-sharing application Limewire installed on a billing computer. In addition, the Sacramento Police Department discovered identity thieves in possession of checks payable to LabMD and LabMD documents containing information of at least 500 consumers.

The ALJ hearing began on May 20 after a number of unsuccessful attempts by LabMD to halt the agency's administrative action. On the eve of the hearing, the Commission denied LabMD's motion for summary decision.

In a May 19 order, Commissioner Joshua D. Wright, writing for the Commission, explained that an evidentiary hearing was necessary to resolve genuine disputes about some of the facts asserted by LabMD. For instance, there were conflicting expert opinions concerning appropriate data security measures. In addition, LabMD argued that the FTC failed to specify what data security standards were in place at any given point during the relevant time period or when LabMD specifically violated them; however, this contention raised at least some disputed factual and legal issues, according to the Commission.

The Commission refused to reconsider many of the arguments that LabMD had raised in its motion to dismiss. In a January Commission order, LabMD's motion to dismiss the administrative complaint was denied. It was determined that the agency plausibly alleged that LabMD's unreasonable security practices amounted to unfair acts or practices. Moreover, the Commission rejected LabMD’s contention that, by enacting the Health Insurance Portability and Accountability Act (HIPAA) and other statutes touching on data security, Congress had implicitly stripped the Commission of authority to enforce Sec. 5 of the FTC Act in the field of data security. The Commission also was unconvinced by LabMD’s “due process” argument. LabMD had contended the Commission could not bring enforcement actions to address statutory violations unless it had adopted specific rules or announced detailed compliance standards in advance. In its most recent order, the Commission explained that LabMD would have to wait for a final order to seek judicial review of these determinations.

Court action. LabMD also was unsuccessful in its attempt to stop the administrative proceedings through a court action. On May 12, the federal district court in Atlanta ruled that it lacked jurisdiction over LabMD's suit to enjoin the FTC enforcement action. LabMD later filed an emergency motion with the U.S. Court of Appeals in Atlanta, seeking to enjoin the ALJ's evidentiary hearing. The request for an injunction pending appeal was denied on May 19.

An initial decision from the ALJ could come late this summer or in the fall.

Attorneys: Alain Sheer for FTC. William A. Sherman II (Dinsmore & Shohl, LLP) and Ronald Lee Raider (Kilpatrick Townsend & Stockton, LLP) for LabMD, Inc.

Companies: LabMD, Inc.

News: Privacy FederalTradeCommissionNews