Identity theft victims can pursue litigation against health insurer: Court

Since December 2009, when two laptops were stolen from AvMed’s office in Gainesville, Florida, the case has been pursued by some of the 1.2 million insured whose personal and health information were on the laptops. In November 2010, five of them filed a potential class action lawsuit,

Although AvMed claimed in November 2010 that there was no misuse of the information and that one of the laptops had been subsequently recovered, the lawsuit alleges that there was misuse of the information. Judy Greenwald reports for Crain’s Business Insurance:

Plaintiffs who were allegedly the victims of identity theft because of the theft of two laptops from their health insurer can pursue their litigation against the firm, said a federal appellate court in partially overturning a lower court’s ruling in the putative class action suit that dismissed the case.

According to Wednesday’s ruling by the 11th U.S. Circuit Court of Appeals in Atlanta in Jean Resnick et al. v. AvMed Inc., in December 2009, two laptop computers containing sensitive information on about 1.2 million current and former AvMed members were stolen from the Gainesville, Fla., office of Miami-based AvMed. This included personal information of Jauna Curry and William Moore, the plaintiffs who were the focus of the ruling.

Ms. Curry’s information was used by an unknown party in October 2010, 10 months after the laptop theft, with Bank of America Corp. accounts opened in her name, as well as credit cards that were activated and used to make unauthorized purchases.

Mr. Moore’s sensitive information was used in February 2011, 14 months after the laptop theft, with an account opened in his name with E-Trade Financial Corp. that was subsequently overdrawn.

[…]

Given the large number of data breaches that occur each year, many of which are never publicly disclosed, I’m not sure how plaintiffs can show that it was this breach that resulted in the fraud on their accounts. But that should me a matter for the trial court, and I agree with the court’s decision overturning the dismissal if there was some proffer that harm had occurred.

But how did this happen if the consumers had signed up for the free Debix services offered by AvMed after the breach? Had they signed up? Did they place security freezes on new accounts?