An Atlanta-based medical laboratory that has been embroiled in a bitter feud with the U.S. Federal Trade Commission over a data breach investigation shut down its operations this week.
In a statement , LabMD CEO Michael Daugherty claimed the FTC's "abuse of power" in pursuing the investigation forced the decision to close the lab.
"The FTC has spent untold taxpayer dollars investigating LabMD, destroying jobs and usurping power over patient information from the U.S. Department of Health and Human Services," Daugherty said.
He accused the FTC of overstepping its authority in going after LabMD and said the agency did not have the Congressional authority to regulate data security practices.
"We are exhausted. When you are a small company you have only that much energy," Daugherty told Computerworld Thursday. Over the past four years, the FTC subpoenaed dozens of LabMD employees, forced its executives fly all over the country for depositions, and subjected the company to numerous requests for information, he said.
In a single day, he said, the federal agency issued 35 subpoenas for 23 simultaneous depositions from executives around the country, he said. "They even wanted depositions with people who left the company several years ago," Daugherty noted.
"It's been an administrative temper tantrum," since 2010 when the FTC first began its investigation, said Daugherty who has published a book describing the episode.
Daugherty's decision to pull the plug on the lab comes just two weeks after an FTC panel rejected a LabMD motion seeking dismissal of the case against, which is now before an FTC administrative panel. About 20 people will lose their jobs when the company winds up operations.
LabMD's battle with the FTC began in 2010 when Tiversa, a provider of peer-to-peer network monitoring services found a 1,719 page billing spreadsheet belonging to the medical lab floating about on a file-sharing network. The LabMD document contained personal information like Social Security Numbers, treatment codes and insurance data on more than 9,000 people.
Tiversa says it discovered the document when conducting research on the inadvertent leakage of sensitive data on P2P networks. The LabMD document was one of thousands of sensitive documents the company found that had leaked on P2P networks during the research effort.
Tiversa's discovery prompted the FTC to launch a broad investigation, asking several companies, including LabMD, whose documents were found on P2P networks, to provide detailed information on data collection, storage and usage practices.
Each of the companies had to provide data on every computer used to collect and store personal information.
Each was also required to provide a "narrative" or a blueprint describing network components in minute detail, down to individual firewalls and routers, and even database tables and field names containing personal data.
The FTC's 12-page Civil Investigative Demand (CID) letter sought details on what each company knew about the leaked data, when they discovered the leaks, why they had allowed P2P software on company systems and what efforts they had taken to inform affected individuals.
In August 2013, after more than two years of discovery, the FTC filed a formal complaint against LabMD alleging that the company had failed to adequately protect sensitive personal data including healthcare information. The complaint alleged that LabMD had exposed data on close to 10,000 consumers in two separate incidents.
Similar administrative action by the FTC have forced numerous companies into costly settlements over the past few years.
In 2006 for instance, the FTC imposed a $10 million fine on data aggregator ChoicePoint, and more recently, online gaming company RockYou paid $250,000 to settle data breach related charges.
Indeed, the complaint against LabMD included a proposed order that would require the company to implement a comprehensive information security program and submit to third-party security evaluations every two years for the next 20 years.
In response, LabMD, assisted by Cause of Action (CoA) a non-profit watchdog group, challenged the FTC's authority to regulate data security practices.
In pleadings and later in a formal lawsuit filed in November, LabMD and CoA asserted that the FTC can't use a section of the FTC Act that prohibits "unfair" and "deceptive" practices, to go after companies that suffer data breaches. They accused the Commission of trying to hold companies to data security standards that do not formally exist.
They contended that Congress has not authorized the FTC to regulate data security practices, particularly those involving healthcare data.
"Despite the Commission's repeated requests, Congress has refused to confer upon the FTC jurisdiction over such data-security cases," CoA had noted in filing the lawsuit. "Therefore, in an end-run around both the courts and the Congress, the Commission illegally abuses and burdens individual businesses like LabMD."
Robert Schoshinski, assistant director at the FTC's division of privacy and identity protection, said the Commission could not comment because the administrative litigation is pending. But Jesse Rich, the director of the Bureau of Consumer Protection noted in a statement that FTC attorneys would determine how best to protect data that LabMD has collected over the years now that it has announced plans to cease operations.
"The goal in this case has always been to ensure that this sensitive information is appropriately protected," she said in the statement.
The LabMD case is one of two to challenge the FTC's enforcement authority in data security matters. Hotel chain Wyndam Worldwide Corp. filed a compliant in federal court raising issues identical to the ones raised by LabMD.
Like LabMD, Wyndham, claims that neither the FTC nor the federal government has ever published a formal set of data security standards so it is unfair for it to penalize companies for failing to live up to criteria that doesn't exist.
Several influential trade groups, including the Chamber of Commerce, TechFreedom, the American Hotel and Lodging Association, the National Federation of Independent Businesses, the International Franchise Association and Cause of Action have filed motions supporting Wyndham and LabMD against the FTC.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His email address is jvijayan@computerworld.com.
Read more about cybercrime and hacking in Computerworld's Cybercrime and Hacking Topic Center.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.