STATE OF INDIANA EX REL ROKITA v. JACKSON COUNTY SCHNECK MEMORIAL HOSPITAL D/B/A SCHNECK MEDICAL CENTER

Filing 15

ORDER APPROVING REVISED CONSENT JUDGMENT - The Parties' Revised Consent Judgment is APPROVED and ENTERED, [dkt. 14-2], such that it will be signed and entered as a separate entry on the Court's docket. Under the terms of the Revised Consent Judgment, the Court retains jurisdiction over its enforcement. Judgment consistent with this ruling shall also issue separately. (SEE ORDER.). Signed by Magistrate Judge Kellie M. Barr on 11/13/2023. (TPS)

UNITED STATES DISTRICT COURT
SOUTHERN DISTRICT OF INDIANA
NEW ALBANY DIVISION
STATE OF INDIANA EX REL ROKITA,
Plaintiff,
v.
JACKSON COUNTY SCHNECK MEMORIAL
HOSPITAL D/B/A SCHNECK MEDICAL
CENTER,
Defendant.

)
)
)
)
)
)
)
)
)
)
)

No. 4:23-cv-00155-KMB-SEB

ORDER APPROVING REVISED CONSENT JUDGMENT
Plaintiff the State of Indiana ex rel. Todd Rokita (the "State") and Defendant Jackson
County Schneck Memorial Hospital ("Schneck Memorial") have filed a Revised Consent
Judgment to resolve this matter. [Dkt. 14-2.] For the reasons discussed below, the Parties' Revised
Consent Judgment is APPROVED and ENTERED.
I. RELEVANT BACKGROUND
The State initiated this action in September 2023, alleging that Schneck Memorial
committed violations of the Health Insurance Portability and Accountability Act ("HIPAA"), the
Indiana Disclosure of Security Breach Act ("DSBA"), and the Indiana Deceptive Consumer Sales
Act ("DCSA"). [Dkt. 1 at 1.] Specifically, the Complaint alleges that in September 2021, an
unauthorized third party committed a ransomware attack on Schneck Memorial and took data from
its systems (the "Data Breach"). [Id. at ¶ 7.] As a result of Schneck Memorial's alleged failure to
employ appropriate safeguards to maintain the security and integrity data, the personal information
and/or protected health information of approximately 89,707 Indiana residents was allegedly
exposed. [Id. at ¶ 10, 22.] According to the State, Schneck Memorial failed to provide direct
notification of the Data Breach to the affected patients in a timely manner. [Id. at ¶ 14.]

Subsequent notice posted on Schneck Memorial's website also allegedly misrepresented when it
had learned of the Data Breach. [Id. at ¶ 16.]
On September 6, 2023, the Parties filed an Agreed Motion to Approve Consent Judgment
and Order. [Dkt. 4.] After holding a Telephonic Status Conference with counsel, the Court denied
the Agreed Motion without prejudice but permitted the Parties to file a revised proposed consent
judgment and ordered the Parties to file a joint brief in support of their proposal explaining why it
is lawful, fair, reasonable, and adequate under precedent from the Seventh Circuit Court of
Appeals. [Dkt. 13.] On October 20, 2023, the Parties filed their Joint Brief in Support of Proposed
Consent Judgment and Revised Consent Judgment and Order. [Dkts. 14; 14-2.]
II. APPLICABLE STANDARD
Parties are typically free to negotiate settlement terms and voluntarily stipulate to dismissal
of a case. Fed. R. Civ. P. 41(a)(1)(A)(ii). Parties may also seek a consent judgment/decree, thereby
requesting that a court retain jurisdiction over a case to enforce compliance with the parties'
settlement terms. A consent judgment is "a court order that embodies the terms agreed upon by
the parties as a compromise to litigation." United States v. Alshabkhoun, 277 F.3d 930, 934 (7th
Cir. 2002). A "federal court is more than 'a recorder of contracts' from whom private parties may
purchase injunctions." Loc. No. 93, Int'l Ass'n of Firefighters, AFL-CIO C.L.C. v. City of
Cleveland, 478 U.S. 501, 525 (1986). "So when the litigants wish to enter a consent [judgment],
to use the office of the court, the judge does not automatically approve but must ensure that the
agreement is an appropriate commitment of judicial time and complies with legal norms." Matter
of Mem'l Hosp. of Iowa Cnty., Inc., 863 F.2d 1299, 1302 (7th Cir. 1998).
Therefore, a court must ensure that certain criteria are met before approving and entering
a consent judgment: a "consent [judgment] proposed by the parties must (1) 'spring from and serve

2

to resolve a dispute within the court's subject matter jurisdiction'; (2) 'com[e] within the general
scope of the case made by the pleadings'; and (3) 'further the objectives of the law upon which the
complaint was based.'" Komyatti v. Bayh, 96 F.3d 955, 960 (7th Cir. 1996) (quoting Int'l Ass'n of
Firefighters, 478 U.S. at 525). Additionally, a court must determine that a proposed consent
judgment is "lawful, fair, reasonable, and adequate." E.E.O.C. v. Hiram Walker & Sons, Inc., 768
F.2d 884, 889 (7th Cir. 1985). "Among the factors that a district court should consider when it
makes this 'fairness' determination are: a comparison of the strengths of plaintiffs' case versus the
amount of the settlement offer; the likely complexity, length, and expense of the litigation; the
amount of opposition to the settlement among affected parties; the opinion of competent counsel;
and, the stage of the proceedings and the amount of discovery already undertaken at the time of
the settlement." Id.
III. DISCUSSION
The Parties have filed their Revised Consent Judgment to resolve the State's claims
regarding the alleged Data Breach described in the Complaint. [Dkt. 14-2.] At a high level, the
Revised Consent Judgment contains injunctive terms that require Schneck Memorial to comply
with relevant laws, implement and maintain an information security program with specific
technical safeguards and controls, undergo third-party compliance assessments for seven years,
and make a $250,000 payment to the State. [Dkt. 14 at ¶ 9.] The Parties represent that the Revised
Consent Judgment is lawful, fair, reasonable, and adequate. [Id. at 6-11.]
The Court agrees that the Parties' Revised Consent Judgment satisfies the factors outlined
by the relevant precedent. The State's Complaint falls within the Court's subject matter jurisdiction
because it alleges that Schneck Memorial violated a federal statute—HIPAA—and the alleged
state law violations form part of the same case or controversy since they stem from the same Data

3

Breach. The Revised Consent Judgment contains terms for injunctive relief that relate to data
security, breach notification practices, and payment to the State, which come within the general
scope of the pleadings. And the proposed terms of injunctive relief seek to facilitate compliance
with HIPAA, DSBA, and DCSA, such that the Revised Consent Judgment furthers the objectives
of the laws that form the basis of the State's allegations.
The Court also concludes that the Revised Consent Judgment is fair, reasonable, and
adequate. There is no opposition to the Revised Consent Judgment, and the Parties represent that
its terms were reached as a result of an arms-length negotiation between the State and Schneck
Memorial. Both Parties were represented throughout negotiations by counsel with experience in
data privacy matters, and the settlement terms were reached after discovery that included written
responses, document productions, and sworn testimony from Schneck Memorial employees.
Nothing has been filed with the Court indicating that additional discovery would aid in resolving
this case, and because of the technical nature of the claims in this case, the Revised Consent
Judgment also helps the Parties avoid the additional expense of expert discovery. The Court
concludes that the $250,000 settlement payment that Schneck Memorial will make to the State is
also reasonable, given the type of allegations at issue herein and that Schneck Memorial is agreeing
to this judgment early in the litigation. 1 Accordingly, the Court finds that the Parties have
demonstrated that the Revised Consent Judgment is appropriate in this case and meets the
requirements outlined by the Seventh Circuit Court of Appeals.

1

The Court notes that the Revised Consent Judgment includes the necessary signatures from the
State's counsel, Schneck Memorial's counsel, and the President and CEO of Schneck Memorial.
4

IV. CONCLUSION
For the reasons stated herein, the Parties' Revised Consent Judgment is APPROVED and
ENTERED, [dkt. 14-2], such that it will be signed and entered as a separate entry on the Court's
docket. Under the terms of the Revised Consent Judgment, the Court retains jurisdiction over its
enforcement. [See Dkt. 14-2 at ¶¶ 10, 42.] Judgment consistent with this ruling shall also issue
separately.
SO ORDERED.
Date: 11/13/2023

Distribution:
All ECF-registered counsel of record via email

5