Lawsuit filed in AvMed data breach

Florida-based health insurer AvMed, which stands atop a federal breach-notification list for the number of people whose personally identifiable information has been compromised, now faces a class-action lawsuit by attorneys representing about 1.2 million health plan members whose records were on two laptop computers that went missing last year from the company's Gainsville headquarters.

Attorneys from Chicago-based Edelson McGuire and Orlando, Fla.-based Wooten, Kimbrough, & Normand filed the suit in Miami-Dade County Circuit Court on behalf of five former and current AvMed customers and all U.S. current and former members of AvMed plans who had their personal health information compromised. The suit alleges there are "at least 1.2 million members of the class" who were harmed by AvMed's violations of Florida's statutory prohibition against misleading advertising and various common law provisions, including breach of contract and negligence.

No specific dollar amount is sought in the suit, which called for statutory and punitive damages as well as restitution "for any identity theft," including the cost of any credit cleanup or liens arising from actions of the defendant.

AvMed estimates that the records of 1.22 million members were on the laptops that went missing Dec. 10, 2009, according to the breach notice posted on an HHS website. The stolen information was stored, unencrypted, according to the suit. The stolen records included current and former members’ names and Social Security numbers and other personal information.

The public breach notification list was established last year under a requirement of the American Recovery and Reinvestment Act of 2009, which established a federal breach notification policy to accompany similar laws in most states.