Billings, MontanaBillings Data Breach
Billings Data Breach Lawyers: Medical Records Breaches, Bank Data Breaches and Website Tracking Privacy Claims in Yellowstone County
Boland Aarab PLLP.
If you received a data breach notice from a Billings hospital, clinic, bank or employer, or your personal information was misused after a breach, you may have a claim. Montana’s breach-notice law requires prompt notice, but Montana’s privacy act does not let consumers sue, so claims rest on other law. Many are heard in federal court in Billings.
Received a data breach notice, or already dealing with fraud? Contact Boland Aarab PLLP for a free consultation at (406) 315-3737.
Why does Billings hold so much sensitive data?
Because Billings is where much of eastern Montana and northern Wyoming goes to see a doctor, bank and work.
- Health care. Billings Clinic and Intermountain Health St. Vincent Regional Hospital are the region’s two largest hospital systems, with clinics and affiliated hospitals across the area. Medical records, insurance numbers, Social Security numbers and payment data for patients from across the region sit in their systems and in the systems of their vendors.
- Banking. First Interstate BancSystem, one of the region’s largest banks, has its headquarters at 401 North 31st Street in downtown Billings (First Interstate). Local banks, credit unions and lenders also hold account and loan data.
- Employers and payroll. Billings’ large employers, from hospitals to refineries to distribution centers, keep employees’ tax forms, direct-deposit numbers and benefits records, often through outside payroll and HR vendors.
- Websites and apps. Patient portals, scheduling pages and bank apps collect more than people realize. In recent years, lawsuits in federal courts around the country, including in Montana, have alleged that health-care websites shared visitors’ browsing information with advertising companies through embedded tracking tools. Those claims are disputed, and how the law applies to them is still developing.
A breach at a Billings institution rarely affects only Billings residents. Patients and customers from across the region, and often from other states, can be in the same data set.
What happens after a data breach affecting Billings residents?
The notice. A business that owns or licenses Montanans’ computerized personal information must notify affected residents “without unreasonable delay” and send a copy of the notice to the Montana Attorney General’s consumer protection office (§ 30-14-1704, MCA). Health care providers also have federal notice duties under HIPAA, generally within 60 days of discovery (45 C.F.R. § 164.404).
What to do now. Keep the letter. Sign up for any free credit monitoring offered, consider a credit freeze, watch your bank and medical statements (including explanation-of-benefits statements for care you never received), change passwords and turn on two-factor authentication. Write down every loss, fee and hour spent fixing the damage. In federal court, concrete harm matters.
Where the case goes. A lawsuit on behalf of one person or a few people can be filed in state court, which for a Billings business is the Thirteenth Judicial District Court at the Yellowstone County Courthouse, 217 North 27th Street (§ 3-5-101, MCA). Class actions with more than $5 million at stake and at least 100 class members can be heard in federal court under the Class Action Fairness Act (28 U.S.C. § 1332(d)). For a breach at a Billings institution, that usually means the Billings Division of the U.S. District Court, at the James F. Battin Federal Courthouse, 2601 2nd Avenue North (District of Montana). National breaches may be consolidated elsewhere as multidistrict litigation.
If a settlement notice arrives. Read it and note the deadlines. You can usually file a claim, do nothing, opt out or object. Doing nothing can still release your claims. If you suffered serious losses, the choice deserves a lawyer’s review before the deadline.
Montana law that applies
- No private right under the privacy act. The Montana Consumer Data Privacy Act is enforced only by the Attorney General (§ 30-14-2817, MCA).
- Claims that may exist: negligence, breach of contract, the Montana Consumer Protection Act for individual (not class) claims with an ascertainable loss (§ 30-14-133, MCA), and certain federal statutes such as the Fair Credit Reporting Act (15 U.S.C. § 1681n).
- HIPAA creates no private right of action, though state-law claims may still be available (Webb v. Smart Document Solutions, 499 F.3d 1078 (9th Cir. 2007)).
- Standing: in federal court, the risk of future harm alone does not support a damages claim (TransUnion LLC v. Ramirez, 594 U.S. 413 (2021)).
- Deadlines: 3 years for most negligence claims (§ 27-2-204, MCA); 2 years for an individual Consumer Protection Act claim (§ 27-2-211, MCA).
Our Montana data privacy and breach page explains notice requirements, federal law and class-action options in more depth.
Why hire a Great Falls firm for a Billings case?
Data breach cases are federal-court cases against large institutions, and they call for lawyers who know that court and will tell you honestly whether your situation is worth pursuing. We are based in Great Falls and handle these cases statewide. Our attorneys travel to Billings for hearings, depositions and trial, and our firm has tried jury trials in Yellowstone County. We do not have a Billings office. Most of the early work in a breach case can be done by phone, email and video.
The Boland Aarab Way
- We know federal court. Our attorneys have handled more than 40 cases in the U.S. District Court for the District of Montana over nine years, and Samir Aarab has argued twice before the Ninth Circuit.
- We take on large institutions. In Estate of Alexander v. Cascade County, a civil-rights and wrongful-death case, we obtained a $550,000 settlement.
- We try cases. More than a dozen jury trials, in Cascade, Phillips, Meagher and Yellowstone Counties, and more than 4,000 hours in the courtroom.
- We tell you the truth. Not every breach is a lawsuit. We will tell you whether yours is. Samir Aarab is a member of Public Justice, and both attorneys belong to the American Association for Justice and the Montana Trial Lawyers Association.
Related Billings pages: medical malpractice · insurance bad faith · all Billings personal injury cases
Frequently Asked Questions
I got a breach letter from a Billings hospital. Do I have a case? Maybe. It depends on what was taken and whether it has been misused or caused you losses. Keep the letter, document any fraud or costs, and have the facts reviewed.
Can I sue under Montana’s privacy law after a Billings breach? Not under the Consumer Data Privacy Act, which only the Attorney General enforces (§ 30-14-2817, MCA). Claims usually rest on negligence, contract or other statutes.
Where would a class action over a Billings data breach be filed? Often in the Billings Division of the U.S. District Court, if it meets the Class Action Fairness Act’s thresholds. National breaches may be consolidated in another federal court.
A Billings website may have shared my health information with advertisers. Is that a data breach? It may raise privacy claims even without a hack. These cases are new, disputed and fact-specific, so a review of what was shared and how is the first step.
I got a class settlement notice. Should I do anything? Read the deadlines. Doing nothing can release your claims. If you had serious losses, talk to a lawyer before the opt-out deadline.
Talk to a Billings Data Breach Lawyer
Contact Boland Aarab PLLP for a free consultation at (406) 315-3737.
Our attorneys: Caitlin Boland Aarab · Samir F. Aarab
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship.
