STATE OF INDIANA EX REL. ROKITA v. APRIA HEALTHCARE LLC

• Court: District Court, S.D. Indiana
• Decided: April 29, 2025
• Docket: 1:24-cv-00377
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF INDIANA INDIANAPOLIS DIVISION

STATE OF INDIANA EX REL. ROKITA, ) ) Plaintiff, ) ) v. ) No. 1:24-cv-00377-JPH-KMB ) APRIA HEALTHCARE LLC, ) ) Defendant. )

ORDER ON CONSENT JUDGMENT

The State of Indiana brought this case against health equipment provider Apria Healthcare alleging that Apria failed to protect consumers' private and sensitive information from data breaches. Dkt. 1; dkt. 39 (amended complaint). The parties have reached a settlement and filed a joint motion for the Court to enter an agreed consent judgment. Dkt. 58; dkt. 59. A consent judgment is "a court order that embodies the terms agreed upon by the parties as a compromise to litigation." United States v. Alshabkhoun, 277 F.3d 930, 934 (7th Cir. 2002). A "consent decree proposed by the parties must (1) 'spring from and serve to resolve a dispute within the court's subject matter jurisdiction'; (2) 'com[e] within the general scope of the case made by the pleadings'; and (3) 'further the objectives of the law upon which the complaint was based.'" Komyatti v. Bayh, 96 F.3d 955, 960 (7th Cir. 1996) (quoting Local No. 93, Int'l Ass'n of Firefighters v. City of Cleveland, 478 U.S. 501, 525 (1986)). Here, the proposed consent judgment would resolve Indiana's claims that Apria violated HIPAA's Breach Notification Rule, Security Rule, and Privacy Rule; the Disclosure of Security Breach Act; and the Indiana Deceptive

Consumer Sales Act. See dkt. 59 at 7. Those claims are within the Court's subject matter jurisdiction because HIPAA authorizes state attorneys general to bring civil actions in United States district court, 42 U.S.C. § 1320d-5(d)(1), and the Court has supplemental jurisdiction over the state-law claims, 28 U.S.C. § 1367(a). See Arizona v. Med. Informatics Eng'g, Inc., No. 3:18-cv-969- RLM-MGG, 2019 WL 2354317 at *1 (N.D. Ind. May 28, 2019). The relief provided by the consent judgment would also further the objectives of the statutes underlying these claims. Apria must "implement all

administrative Safeguards and Technical Safeguards required by HIPAA" and follow the Disclosure of Security Breach Act and Indiana Deceptive Consumer Sales Act in safeguarding personal information. Dkt. 58-1 at 8. Apria also must "implement and maintain" an information-security program and an incident response plan and oversee third-party vendors who have access to its network. Id. at 9–11. The settlement payment of $1,000,000 is within the amount authorized by applicable statutes and "properly accounts for the scope of the breach impacting at least 42,021 Indiana residents, the sensitivity of the

compromised information, and the severity of the alleged violations." Dkt. 59 at 10–11. And allocation of the payment "for any purpose allowable under Indiana law" follows Indiana Code § 4-6-3-2.4(a). See id. Each of these requirements, along with the other requirements in the consent judgment, falls within the statutes' objectives of safeguarding consumers' personal information. See Ind. ex rel. Rokita v. Johnson Cnty. Schneck Mem. Hosp., 4:23- cv-155-KMB-SEB, 2023 WL 7485516 at *2 (S.D. Ind. Nov. 13, 2023). The Court therefore APPROVES the consent judgment, dkt. 58-1, which the Clerk shall docket as a separate docket entry. Because the Court retains jurisdiction as the parties have agreed, dkt. 58-1 at 4, 26, this case is DISMISSED without prejudice. See Shapo v. Engle, 463 F.3d 641, 643 (7th Cir. 2006). Final judgment will issue by separate entry. SO ORDERED. Date: 4/29/2025 Sjamnu Patnaik Hanbore James Patrick Hanlon United States District Judge Southern District of Indiana

Distribution: All electronically registered counsel