Investigation into data breach could head to court

pHELENA In October MTN reported on a major data breach involving customers with Blue Cross Blue Shield of Montana Now as a state investigation into the breach continues the next steps could be playing out in courtppBCBSMT the largest health insurance provider in Montana said in October that up to 462000 of its members data may have been exposed by a cyber incident affecting Conduent a thirdparty vendor The company reported the incident to Montana State Auditor James Browns office which launched an investigationppNow BCBSMT is arguing the auditors actions have been unlawful The company filed a lawsuit in state district court in Helena claiming Browns office doesnt have the authority to pursue an investigationppWatch the video for more on whats next in the legal battle over the investigationppRegulators said they were looking into whether BCBSMT complied with a state law that requires insurers to provide notice when they experience a data breach However BCBSMT says it has been exempt from that requirement because they were instead covered under a federal lawppLast year the Montana Legislature passed and Gov Greg Gianforte signed House Bill 60 which changed that law to require companies with that federal exemption to still follow the data breach notification rules BCBSMT says HB 60 didnt take effect until Oct 1 and that they learned about the breach from Conduent on July 1 and completed their own analysis of the impacts on member data on Sept 23 The company argues there was no provision to make the bill retroactive so their exemption still applies to any breach that happened before Oct 1ppBCBSMT reported the breach to Browns office after Oct 1 but argued that was a courtesy notification not actually requiredppIn a complaint BCBSMTs attorneys said allowing the auditors office to continue its investigation would create immediate and ongoing irreparable harm including regulatory coercion compelled compliance with inapplicable statutory provisions disruption to BCBSMTs operations and loss of the statutory protectionsppThe auditors office argued that it has long interpreted state law to require companies to report data breaches regardless of the exemption BCBSMT pointed to They said the court doesnt have the authority to step in to this case until the offices administrative process is complete and they said theres still no guarantee theyll even find a violationppAssuming that the final order is adverse to BCBSMT which is not a fait accompli there is no dispute that BCBSMT may seek judicial review they said But the insurance companys request for a preliminary injunction must be deniedppBrowns office scheduled a public hearing on BCBSMT and the data breach for Jan 22 The company asked the court for a restraining order to stop the hearing but District Judge Chris Abbott allowed it to go forward A hearing examiner took testimony and will begin work on possible recommendations in the coming weeks Whatever recommendations the examiner makes will go to Brown for a final decisionppOn Wednesday the two sides appeared before Abbott for a hearing on BCBSMTs request for a preliminary injunction to halt the auditors investigation The judge has not yet made a rulingppTyler Newcombe a spokesperson for Browns office released a statement to MTNppIt is deeply troubling that after a data breach affecting hundreds of thousands of Montanans Blue Cross Blue Shield sought to avoid regulatory scrutiny by suing the State and attempting to block this hearing he said These types of hearings occur regularly and are a standard part of regulatory oversight No company is entitled to special treatment Montanans deserve transparency and accountability when their personal and health data may have been placed at risk and our office is simply asking to follow the evidence and reach a conclusion in due courseppMTN reached out to BCBSMT for a response The company declined to comment on ongoing litigationp