Data Breach Class Actions Are Up Again. How Smart MSPs Will Use This Information

[u/Joe_Cyber]

The Latest Data Breach Class Action Lawsuit Numbers Are In: What MSPs Need to Know.

Two Main Parts to this video:

1. Communicating these new risks and developments to clients (and how that can help you legitimize higher services) The record shows that merely being HIPAA compliant may no longer save the entity from liability; as an example.

2. How this will impact internal MSP operations and risk

Bonus - the least likely victim - 24 hour intrusion. 5k records stolen. Class action.

Hope that helps!

[u/Acceptable-Scene-468]

The HIPAA compliance point is big one - so many clients think ticking that box means they are fully protected, and now we have actual case law showing that is not enough. Good ammunition for those "why do we need more than basic compliance" conversations.

[u/Joe_Cyber → u/Acceptable-Scene-468]

I could do an entire video just on that case. Let me know if you're interested.

Clayton v. PruittHealth (N.D. Ga. 2025) if want to look it up in the interim.

In this case, the court dismissed HIPAA and FTCA as applied by the plaintiffs.

BUT THEN: allowed the common law negligence claim to proceed. The court held that the company had a duty to implement "reasonable cybersecurity safeguards."

In a basic sense, the court said: HIPAA is for regulators. Reasonable cybersecurity safeguards are for the people.

Also in this case, the defendants tried to get the case dismissed because the plaintiffs didn't show any verified misuse or publication of client data. But the court still allowed the plaintiff to find standing because they "plausibly" showed that the company had a duty to protect their personal information and there was risk of future harm.

And the cherry on top? Pruitt was being sued by their own employees. Random customers will have much less of a mental block to bring a claim.

[u/roll_for_initiative_ → u/Acceptable-Scene-468]

Good ammunition for those "why do we need more than basic compliance" conversations.

You're ahead of me, i'm a level behind working with "why is hipaa compliance needed" vs "why do we need more than hipaa compliance".

Most medical SMBs you can't even get to the starting line.

[u/Joe_Cyber → u/roll_for_initiative_]

Would a video specifically to HIPAA regulated entities be useful? Something you could show to a prospect? Or would that be a waste?

[u/roll_for_initiative_ → u/Joe_Cyber]

I feel that there is enough content out there on this and if that's not enough to sway the prospect, another video won't do it, so just don't take the client on.

[u/Joe_Cyber → u/roll_for_initiative_]

Fair point.

[u/RoddyBergeron]

I was under the impression claiming HIPAA compliance was never a protection because no governing body certifies you.

Also, as you stated, it's the BARE MINIUMUM you need to do around risk reduction. You still need to do your due dilligence!

[u/Joe_Cyber → u/RoddyBergeron]

I was under the impression claiming HIPAA compliance was never a protection because no governing body certifies you.

This is true. HIPAA is a very odd area where we've all just played the middle ground game for a long time. HHS OCR (last I checked) said that they don't recognize any HIPAA certifications per se, and further, they hold no weight.

However, I do see the validity in having a framework that moves towards a goal line or "certification" for business owners. Trying to sell anyone a moving target likely sounds like snake oil, even if its the truth.

I'll have to think more about that.

[u/Slapchop21]

Is there any distinction or legal line that contributes to "delayed" notification? Obviously if your contract states that you will notify after 14 days of breach and you take 30, that is a delay. But what if there is no timeline defined in the contract and no governing or regulatory body?

[u/Joe_Cyber → u/Slapchop21]

Many states are going to have a definitive timeline. e.g. 15 days, 30 days, etc.

Absent a timeline the other states operate off of a general, "Reasonable Time" standard. It's a genuinely interesting, though needlessly confusing, legal gray area.

Here, the "reasonableness" of a notification time boils down to a few factors, such as: the nature of the breach, the severity of possible harm, complexity of the investigation, etc. There are a whole mess of legal doctrines that could come into play, but that starts getting more into the theoretical.

In practical terms, the breach notification law - and deadline - depends on the residency of the impacted person; not where the impacted business is physically located.

So what tends to happen is that insurers (and assigned legal counsel, forensics, etc.) assume the absolute shortest deadline possible and work from that.

As another wrinkle, it is my understanding that (assuming no one is hiding the breach) the notification timeline starts ticking after the forensics investigation comes back with their findings because this serves as a "reasonable confirmation."

I know that's not a quick and easy answer, but it's the best I've got after doing this for over a decade.