STATE OF INDIANA EX REL ROKITA v. JACKSON COUNTY SCHNECK MEMORIAL HOSPITAL D/B/A SCHNECK MEDICAL CENTER

• Court: District Court, S.D. Indiana
• Decided: November 13, 2023
• Docket: 4:23-cv-00155
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF INDIANA NEW ALBANY DIVISION

STATE OF INDIANA EX REL ROKITA, ) ) Plaintiff, ) ) v. ) No. 4:23-cv-00155-KMB-SEB ) JACKSON COUNTY SCHNECK MEMORIAL ) HOSPITAL D/B/A SCHNECK MEDICAL ) CENTER, ) ) Defendant. )

ORDER APPROVING REVISED CONSENT JUDGMENT

Plaintiff the State of Indiana ex rel. Todd Rokita (the "State") and Defendant Jackson County Schneck Memorial Hospital ("Schneck Memorial") have filed a Revised Consent Judgment to resolve this matter. [Dkt. 14-2.] For the reasons discussed below, the Parties' Revised Consent Judgment is APPROVED and ENTERED. I. RELEVANT BACKGROUND The State initiated this action in September 2023, alleging that Schneck Memorial committed violations of the Health Insurance Portability and Accountability Act ("HIPAA"), the Indiana Disclosure of Security Breach Act ("DSBA"), and the Indiana Deceptive Consumer Sales Act ("DCSA"). [Dkt. 1 at 1.] Specifically, the Complaint alleges that in September 2021, an unauthorized third party committed a ransomware attack on Schneck Memorial and took data from its systems (the "Data Breach"). [Id. at ¶ 7.] As a result of Schneck Memorial's alleged failure to employ appropriate safeguards to maintain the security and integrity data, the personal information and/or protected health information of approximately 89,707 Indiana residents was allegedly exposed. [Id. at ¶ 10, 22.] According to the State, Schneck Memorial failed to provide direct notification of the Data Breach to the affected patients in a timely manner. [Id. at ¶ 14.] Subsequent notice posted on Schneck Memorial's website also allegedly misrepresented when it had learned of the Data Breach. [Id. at ¶ 16.] On September 6, 2023, the Parties filed an Agreed Motion to Approve Consent Judgment and Order. [Dkt. 4.] After holding a Telephonic Status Conference with counsel, the Court denied

the Agreed Motion without prejudice but permitted the Parties to file a revised proposed consent judgment and ordered the Parties to file a joint brief in support of their proposal explaining why it is lawful, fair, reasonable, and adequate under precedent from the Seventh Circuit Court of Appeals. [Dkt. 13.] On October 20, 2023, the Parties filed their Joint Brief in Support of Proposed Consent Judgment and Revised Consent Judgment and Order. [Dkts. 14; 14-2.] II. APPLICABLE STANDARD Parties are typically free to negotiate settlement terms and voluntarily stipulate to dismissal of a case. Fed. R. Civ. P. 41(a)(1)(A)(ii). Parties may also seek a consent judgment/decree, thereby requesting that a court retain jurisdiction over a case to enforce compliance with the parties' settlement terms. A consent judgment is "a court order that embodies the terms agreed upon by

the parties as a compromise to litigation." United States v. Alshabkhoun, 277 F.3d 930, 934 (7th Cir. 2002). A "federal court is more than 'a recorder of contracts' from whom private parties may purchase injunctions." Loc. No. 93, Int'l Ass'n of Firefighters, AFL-CIO C.L.C. v. City of Cleveland, 478 U.S. 501, 525 (1986). "So when the litigants wish to enter a consent [judgment], to use the office of the court, the judge does not automatically approve but must ensure that the agreement is an appropriate commitment of judicial time and complies with legal norms." Matter of Mem'l Hosp. of Iowa Cnty., Inc., 863 F.2d 1299, 1302 (7th Cir. 1998). Therefore, a court must ensure that certain criteria are met before approving and entering a consent judgment: a "consent [judgment] proposed by the parties must (1) 'spring from and serve to resolve a dispute within the court's subject matter jurisdiction'; (2) 'com[e] within the general scope of the case made by the pleadings'; and (3) 'further the objectives of the law upon which the complaint was based.'" Komyatti v. Bayh, 96 F.3d 955, 960 (7th Cir. 1996) (quoting Int'l Ass'n of Firefighters, 478 U.S. at 525). Additionally, a court must determine that a proposed consent

judgment is "lawful, fair, reasonable, and adequate." E.E.O.C. v. Hiram Walker & Sons, Inc., 768 F.2d 884, 889 (7th Cir. 1985). "Among the factors that a district court should consider when it makes this 'fairness' determination are: a comparison of the strengths of plaintiffs' case versus the amount of the settlement offer; the likely complexity, length, and expense of the litigation; the amount of opposition to the settlement among affected parties; the opinion of competent counsel; and, the stage of the proceedings and the amount of discovery already undertaken at the time of the settlement." Id. III. DISCUSSION The Parties have filed their Revised Consent Judgment to resolve the State's claims regarding the alleged Data Breach described in the Complaint. [Dkt. 14-2.] At a high level, the

Revised Consent Judgment contains injunctive terms that require Schneck Memorial to comply with relevant laws, implement and maintain an information security program with specific technical safeguards and controls, undergo third-party compliance assessments for seven years, and make a $250,000 payment to the State. [Dkt. 14 at ¶ 9.] The Parties represent that the Revised Consent Judgment is lawful, fair, reasonable, and adequate. [Id. at 6-11.] The Court agrees that the Parties' Revised Consent Judgment satisfies the factors outlined by the relevant precedent. The State's Complaint falls within the Court's subject matter jurisdiction because it alleges that Schneck Memorial violated a federal statute—HIPAA—and the alleged state law violations form part of the same case or controversy since they stem from the same Data Breach. The Revised Consent Judgment contains terms for injunctive relief that relate to data security, breach notification practices, and payment to the State, which come within the general scope of the pleadings. And the proposed terms of injunctive relief seek to facilitate compliance with HIPAA, DSBA, and DCSA, such that the Revised Consent Judgment furthers the objectives

of the laws that form the basis of the State's allegations. The Court also concludes that the Revised Consent Judgment is fair, reasonable, and adequate. There is no opposition to the Revised Consent Judgment, and the Parties represent that its terms were reached as a result of an arms-length negotiation between the State and Schneck Memorial. Both Parties were represented throughout negotiations by counsel with experience in data privacy matters, and the settlement terms were reached after discovery that included written responses, document productions, and sworn testimony from Schneck Memorial employees. Nothing has been filed with the Court indicating that additional discovery would aid in resolving this case, and because of the technical nature of the claims in this case, the Revised Consent Judgment also helps the Parties avoid the additional expense of expert discovery. The Court

concludes that the $250,000 settlement payment that Schneck Memorial will make to the State is also reasonable, given the type of allegations at issue herein and that Schneck Memorial is agreeing to this judgment early in the litigation.1 Accordingly, the Court finds that the Parties have demonstrated that the Revised Consent Judgment is appropriate in this case and meets the requirements outlined by the Seventh Circuit Court of Appeals.

1 The Court notes that the Revised Consent Judgment includes the necessary signatures from the State's counsel, Schneck Memorial's counsel, and the President and CEO of Schneck Memorial. IV. CONCLUSION For the reasons stated herein, the Parties’ Revised Consent Judgment is APPROVED and ENTERED, [dkt. 14-2], such that it will be signed and entered as a separate entry on the Court's docket. Under the terms of the Revised Consent Judgment, the Court retains jurisdiction over its enforcement. [See Dkt. 14-2 at J§ 10, 42.] Judgment consistent with this ruling shall also issue separately. SO ORDERED. Date: 11/13/2023 Koll I Fann Kellie M. Barr United States Magistrate Judge Southern District of Indiana Distribution: All ECF-registered counsel of record via email