Medical Cannabis Firm Sued Over Health Data Exposure

A security researcher’s recent discovery of a non-password protected, unencrypted database exposing the personal records of nearly one million medical marijuana patients has triggered at least six lawsuits against an Ohio company that helps patients qualify for physician-certified medical marijuana cards.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The proposed class action lawsuits filed in recent days in a Ohio federal court against Ohio Medical Alliance, which does business as Ohio Marijuana Card, seek financial damages and allege similar claims. They say the company was negligent in failing to safeguard the sensitive personal and health information of plaintiffs and class members from compromises that put the individuals at risk for fraud, identity theft and other misuse.

Ohio Medical Alliance offers telemedicine appointments with “state-certified medical marijuana doctors” to discuss the patients’ medical conditions to determine whether the person qualifies for medical marijuana treatments.

“Once approved by the doctor, you’ll receive your physician certified card via email from the Ohio Board of Pharmacy,” which enables the patient to purchase medical marijuana products.

Ohio Medical Alliance says on its website that it does not accept insurance. “Insurance does not cover cannabis consultations at this time. Our fingers are crossed that we can someday soon,” the website said.

Exposed Records

At the center of the lawsuits are findings in a report last month by security researcher Jeremiah Fowler of his discovery of an unsecured 300 gigabyte database exposing 957,434 patient records containing a wide trove of information and documents (see: Breach Roundup: Scattered Spider Hacker Gets 10 Years).

The database, which Fowler said lacked password protection and encryption, included high-resolution images of driver’s licenses and identification documents that contained names, physical addresses, date of birth and license numbers, Fowler said.

The exposed folders were labeled with the first and last names of patients and included intake forms, medical records, release forms, physician certification forms with Social Security numbers, mental health evaluations and identification documents from multiple states, he wrote.

“These medical documents indicated the patients’ diagnosis and the reason they were seeking to be prescribed medical marijuana,” Fowler wrote.

Other exposed information included documents containing an estimated 210,620 email addresses of clients and internal employees or business partners, Fowler said.

Fowler said that after he found the exposed database between July 12 and 13, he contacted Ohio Medical Alliance on July 14, and the database was then restricted from public access the following day and no longer accessible.

Although the records appeared to belong to Ohio Medical Alliance, Fowler said it is unclear if the database was owned and managed directly by the firm or by a third-party contractor. “It is also not known how long the database was exposed before I discovered it or if anyone else may have gained access to it. Only an internal forensic audit could identify additional access or potentially suspicious activity,” Fowler wrote.

Lawsuit Allegations

Among other claims, some of the lawsuits against Ohio Medical Alliance – including one filed on Wednesday – allege the company has still not publicly disclosed the cybersecurity incident, its cause or its duration.

Ohio Medical Alliance did not immediately respond to Information Security Media Group’s request for comment on the lawsuits and on Fowler’s report.

Fowler told ISMG on Friday that he still has not received any communication from Ohio Medical Alliance, even after he sent his responsible disclosure notice to the company about his discovery.

“They simply restricted access to the files and never replied,” he said. “They never informed me of any notification process” to affected individuals or regulators about the incident, he said.

So far, Fowler also said he has not been contacted by any attorneys in the lawsuits against OMA involving his discovery. “I have not received any messages from anyone in this case. As an ethical researcher, I do not download information or documents,” he said.

Fowler has frequently reported on discovering many other internet-exposed databases containing sensitive health and other personal information (see: Clinical Trial Database Exposes 1.6M Records to the Web).

“It is never my goal or purpose to have my findings end up causing litigation or legal issues for an organization,” he told ISMG.

“I have found some very sensitive information over the years and the one thing organizations should remember is that at the end of the day these are real people and their digital identities or personal data must be protected,” he said.

“When companies provide a product or a service the need to understand that personal data is equally as valuable,” he said. “The real issue is having a patchwork of data protection laws that are far behind modern technology. Medical data and HIPAA regulations are the one area where there is a good framework of legal reporting requirements and accountability.”

Regulatory Patchwork

Some regulatory attorneys told ISMG that Ohio Medical Alliance does not appear to be a HIPAA-covered entity, but it does appear to be a HIPAA business associate that must comply with the HIPAA privacy, security and breach notification rules.

“Under HIPAA, a healthcare provider qualifies as a covered entity only if it electronically transmits PHI in connection with standard transactions, such as insurance claims or eligibility checks,” said attorney Andrew Mahler of privacy and security consulting firm Clearwater, who is not involved in the OMA cases.

“Since OMA explicitly states it does not accept insurance, it may not meet the definition of a covered entity under HIPAA,” Mahler said. “However, if it provides services to HIPAA-regulated entities and handles PHI on their behalf, it could still be considered a business associate and subject to HIPAA obligations,” he said.

Regulatory attorney Paul Hales of the Hales Law Group offers a similar assessment, concluding that OMA is likely a HIPAA business associate because it conducts video telemedicine consultations between physicians who are HIPAA-covered entities and OMA’s customers.

“However, HIPAA is probably not the most worrisome law for OMA. Plaintiffs have a rich store of state and federal laws to call upon,” said Hales, who also is not involved in the cases.

Indeed, when it comes to data breaches involving medical – or recreational – marijuana businesses, things can get even trickier from a legal perspective, Mahler said.

“The regulatory landscape can vary widely between medical and recreational marijuana services,” he said.

“Medical marijuana services that interact with protected health information due to their role in patient care, diagnosis or record management will likely be subject to HIPAA, and potentially other healthcare privacy laws,” he said.

“Other organizations, including those that only deal with recreational marijuana, may appear to interact with PHI, but don’t meet the definition of a HIPAA-covered entity or business associate,” he said. “However, the company may still have federal and state consumer data privacy law and breach notification requirements.”

Hales said it’s critical that any and every organization handling personally identifiable information must continually assess and address the risks to the privacy and security of that data.

“Comprehensive new state data protection laws reflect nationwide concerns about the alarming rise of cybersecurity threats and identity theft,” he said.

The Ohio Medical Alliance incident underscores a recurring issue in the healthcare space: a lack of clarity and consistency in data protection practices, Mahler said.

“It also serves as another stark reminder of the urgency of rigorous data protections, including reviews of systems and applications that may handle or maintain sensitive data, especially for organizations in emerging, highly regulated industries,” he said.

In the meantime, Hales said he expects the Ohio Medical Alliance lawsuits “to follow the familiar and exhausting path” of pretrial motions common to health information data breach class actions, ending in a settlement.

As is often the case in data breach lawsuit settlements, “individual class members are likely to receive minimal monetary damages,” Hales predicted.