The Arkansas Attorney General ('AG') announced, on 17 March 2022, that he had filed a lawsuit against Country Medical Services of Arkansas, Inc., doing business as Collection Liquidators of America, Duke Family Medical Center, Eastern Ozarks Home Health and Hospice, Eastern Ozarks Internal Medicine Clinic, Eastern Ozarks Medical Clinic, Eastern Ozarks Physical Therapy and Rehabilitation, and Eastern Ozarks Regional Health System (collectively referred to as 'Eastern Ozarks'). In particular, the AG noted that Eastern Ozarks had failed to protect sensitive patient information, both personal and medical, after the hospital closed, thus allegedly violating the Personal Information Protection Act ('PIPA') and the Arkansas Deceptive Trade Practices Act ('ADTPA'). Furthermore, the AG detailed that Eastern Ozarks closed in December 2004, and several files containing personal and health data of patients and former employees have been abandoned in the unsecured building. Moreover, the AG stated that the facility had been vandalised and subject to unauthorised access, and many files throughout the property appeared to have been examined. 

Lastly, the AG highlighted that the lawsuit alleges that Eastern Ozarks had failed to provide proper security measures and can therefore face penalties of up to $10,000 for each violation of the PIPA and the ADTPA.

You can read the press release here and the lawsuit here.