In August 2013, after a document containing the personal information of about 9,300 patients was posted to a peer-to-peer file sharing network, the FTC filed an administrative action against LabMD alleging that its failure to safeguard its data constituted a violation of the Federal Trade Commission Act.
In November and December 2013, LabMD responded by: (1) moving to dismiss the administrative action, (2) filing suit for declaratory and injunctive relief in the District Court for the District of Columbia, and (3) moving to stay the administrative proceedings in the 11th Eleventh Circuit. In all three actions, LabMD argued that the FTC Act does not grant the FTC power to regulate data breaches and, as a HIPAA-covered entity, LabMD only must answer to the Department of Health and Human Services regarding its data security practices.
After the Eleventh Circuit declined to exercise jurisdiction over its motion to stay, LabMD voluntarily withdrew its suit in the District of Columbia and, in March 2014, filed an identical action in the Northern District of Georgia. On May 12, the Northern District of Georgia determined that, in the absence of final agency action, LabMD’s alleged injuries were not ripe for review and, on May 19, the Eleventh Circuit denied LabMD’s emergency motion to stay the administrative proceedings pending an appeal.
But it did not end there. While the FTC administrative proceedings resumed on May 20, the House Committee on Oversight and Government Reform launched an investigation into Tiversa, Inc., a company that provided the FTC with much of the information that formed the basis for its enforcement action against LabMD. When former Tiversa employee Rick Wallace, a key witness in the enforcement action, notified the administrative law judge that he would be pleading the Fifth Amendment, the proceedings were recessed until June 12. On June 11, the chair of the House panel, Darrell Issa, wrote a letter to FTC Chair Edith Ramirez stating that “the information provided to the FTC [by Tiversa] is incomplete and inaccurate.” On June 12, the administrative proceedings were stayed pending negotiations between Mr. Wallace and the House panel over a grant of immunity for his testimony. On June 17, Congressman Issa requested that the FTC Inspector General review the FTC’s relationship with Tiversa.