In a 65-page complaint filed this week in federal court, Vincent Green with Motley Rice LLC in Rhode Island, along with cooperating attorneys in Washington, DC, alleged that the consulting giant “failed to properly secure and safeguard the personally identifiable information and personal health information…of the Class, resulting in a data breach of the RIBridges computer software system, which is administered and operated by [Deloitte].”
United States District of Rhode Island Judge Jack McConnell had earlier in his career practiced at Motley Rice, where he served as a negotiator and primary drafter of the Master Settlement Agreement on behalf of the State Attorneys General to recoup medical expenses from the tobacco industry.
The lawsuit filed by Green this week in district court has not yet been assigned to a judge.
Motley Rice v. Deloitte
Currently, there are a half dozen other lawsuits that have been filed against Deloitte over the data breach in U.S. District Court.
The federal lawsuit filed this week by Green with Motely Rice is on behalf of Renee Triguiero, “individually and on behalf of all other similarly situated” allowing for a class action.
In December, Governor Dan McKee, in an unprecedented Friday night news conference, let Rhode Islanders know that RIBridges - the state’s system to support everything from SNAP benefits to Medicaid to HealthsourceRI - had been hacked. McKee has signed an extension with Deloitte - SEE TIMELINE OF DELOITTE AND RI BELOW.
The number of Rhode Islanders impacted is in the hundreds of thousands; Rob Fitzgerald of Blue Mantis, a leading technology firm with a specialty in cybersecurity, told GoLocal it "could not be worse."
Motley Rice says Deloitte is to blame in the new federal lawsuit.
“Defendant disregarded the rights of Plaintiff and Class Members by, among other things, intentionally, willfully, recklessly, or negligently failing to implement adequate and reasonable measures to protect its data systems against unauthorized intrusions; failing to take standard and reasonably available steps to prevent the Data Breach; and failing to provide Plaintiff and Class Members prompt and accurate notice of the Data Breach,” according to the lawsuit.
Moreover, the lawsuit asserts the breach has the capacity to cause present and future harm.
“With access to the Private Information obtained in the Data Breach, data thieves have already engaged in identity theft and fraud. Additionally, the data thieves can and will commit crimes in the future including, for example, opening new financial accounts in Class Members’ names, taking out loans in Class Members’ names, using Class Members’ information to obtain government benefits, filing fraudulent tax returns using Class Members’ information, obtaining driver’s licenses in Class Members’ names but with another person’s photograph, and giving false information to police during an arrest,” the lawsuit alleges.
Motley Rice is suing on five counts - Negligence, Breach of Implied Contract, Unjust Enrichment, Breach of Third-Party Beneficiary Contract, and Violation of Rhode Island’s Unfair Trade Practice and Consumer Protection Act.
Green did not respond to request for additional comment at time of publication.
History of Deloitte and UHIP in Rhode Island
2013 — “Original” Budget
The project — which goes back to the Chafee administration, which saw federal funding on the table for the technology for both boosting enrollment and tracking beneficiaries under Obamacare — was originally budgeted to cost between $110 and $135 million.
UHIP officially launched in 2013 with the “ultimate” goal of saving Rhode Islanders “more than $90 million each year, including more than $40 million in state general revenue.”
2015 — Costs Tripled
The UHIP cost tripled to $364 million by 2015 — even before the hybrid portal was launched. And taxpayer groups weighed in.
“With a similar net cost to Rhode Islanders as the 38 Studios debacle and the initial 38 Stadium proposal, the UHIP project is yet another example of government inefficiency and special interest spending, which will consume upwards of $77 million in state taxpayer dollars as well as hundreds of millions from federal taxpayers," wrote the Rhode Island Center for Freedom and Prosperity in September 2015.
2016 — Rollout By Raimondo Administration "Beyond Embarrassment"
“Impatience on behalf of state agencies’ leaders and inadequate preparation resulted in a half-baked program being thrust upon Rhode Islanders," said Finance Chairwoman Patricia Serpa in October of 2016.
"This time, it went beyond embarrassment and inconvenience, leaving our most vulnerable citizens — children, the elderly, the disabled, the needy — without support. This avoidable blunder affected thousands of human lives, and those responsible for it should account for their actions,” she added.
Rhode Island's biggest-ever IT project launched at the end of September — and what was originally a $135 million budget turned into $364 million the prior year. The state requested an additional $124 million in federal funding to bring the total to nearly a half billion dollars, for roughly $487.4 million from 2011 through 2018.
2016 — RI's Consultant, Deloitte, Had Problems With a Similar Project in Kentucky
Program vendor Deloitte had come under fire in Kentucky for the rollout of their “one-stop shop for benefits,” called “benefind.”
The launch of a new state public benefit system drew harsh criticism Thursday from lawmakers, with one calling for a state attorney general's examination of the contract with Deloitte Consulting, the company that built the $100-million system known as benefind.
"It seems like our most vulnerable populations are the ones who have paid for the shortcomings," Sen. Danny Carroll, a Paducah Republican, said of the system that caused massive disruptions in public benefits such as Medicaid and food stamps earlier this year. "Maybe that's something the attorney general should take a look at."
Carroll, co-chairman of the joint House-Senate Program Review and Investigations Committee, which held Thursday's hearing, suggested the attorney general could review whether Kentucky could recoup any of the funds it paid Deloitte and whether the contract offered sufficient protection to Kentucky in light of problems with the launch.
2017 — More Money Needed to Fund UHIP and Deloitte
Rhode Island then looked for an additional $124 million from the federal government for Fiscal Year 2018.
‘’This project continues to come in under the $364M that we have stated will be the cost for the first 5 years of the project. The request...to the federal government for authorization [is] for up to an additional $123.6M,” said Sophie O’Connell with the Rhode Island Office of Health and Human Services.
"This request preserves the state’s ability to consider policy options for accessing an elevated level of federal matching funds in the future. These are not base project costs and this represents a request for authorization for federal funding which may or may not become part of an EOHHS budget request to the Governor and then the General Assembly for FY18. We expect to receive a response from the federal government on this request this fall," said O'Connell.
January, 2017 — Raimondo Takes "Decisive Action" Months Later
As GoLocal reported in 2017:
Governor Gina Raimondo announced on Thursday that she took “decisive action” nearly four months following the botched UHIP rollout by accepting the resignations of two high-level staffers and withholding millions in payments to vendor Deloitte.
Critics of UHIP, which has adversely impacted thousands and is the subject of an ACLU lawsuit, were not impressed, however, by Raimondo’s assertion that action was taken quickly or effectively — and questioned the ousting of Melba DePena and Thom Guertin while keeping Secretary of Health and Human Services, Elizabeth Roberts.
“After four long months, the issue is not firing two people who weren't the real decision-makers,” said House Minority Leader Patricia Morgan. “The issue is why the top leaders chose to launch a woefully incomplete system to begin with. Those leaders knew it was not ready. "
“This is Governor Raimondo's total failure of leadership and the height of her arrogance,” said Republican Party Chair Brandon Bell. “She ignored warnings about launching from the federal government, she fired approximately 40 people prematurely and she hired political people who had no business running the Department of Human Services."
Among those who criticized Raimondo on Thursday was Nicholas Oliver with the Rhode Island Partnership for Home Care, who has seen significant ramifications result from the UHIP problems.
“Removing DHS Director DePena and Chief Digital Officer Guertin does not resolve provider reimbursement delays, nor resolves the current access to healthcare barriers caused by this UHIP implementation failure. I was underwhelmed by the Governor’s remarks today,” said Oliver.
February 2017 — Roberts Out, Wood Demoted
GoLocal reported:
Former Rhode Island Lt. Governor Elizabeth Roberts will resign as Secretary of Health and Human Services. In addition, Jennifer Wood who has served as Roberts' long-time deputy will be demoted.
The most damning development will be the release on Thursday of a report drafted in part by top Raimondo staffer Eric Beane.
That report will be released to the House Oversight Committee and is expected to unveil serious issues in management, decision-making, and a technology that is more flawed than previously reported.
February 2017 — Raimondo Speakes at Deloitte Conference
GoLocal unveiled that then-Governor Gina Raimondo was in California - at an event sponsored by UHIP consultant Deloitte, who she blasted earlier that week.
As GoLocal reported:
Raimondo's schedule for Friday lists partial details about the "Girls Who Code" summit.
But the Girls Who Code Facebook page provides even more information, including sponsor Deloitte.
"We paid them a lot of money, we didn’t get what we paid for," Raimondo said on Wednesday, of Deloitte's involvement in the UHIP debacle. "And they represented to us that it was in much better shape than in fact it was: defective functionality, incomplete interfaces, engines that still aren’t working."
"Deloitte is not paying for any of the travel," said Raimondo spokesperson David Ortiz on Friday. "She had already committed to be at the event, and was able to have a private conversation with the CEO of Deloitte consulting, who committed to being in regular communication with the Governor."
2017 — More Deloitte Problems
In 2017, there were more problems linked to Deloitte.
2019 — $11 Million Paid to Dead People and Other Key Findings of RI State Audit
GoLocal reported:
The Office of the Auditor General of Rhode Island issued a blistering report unveiling the payment of approximately $11 million paid to 10,800 dead people and other serious failures.
The report released before the House Oversight Commission by Rhode Island Auditor General Dennis Hoyle found serious flaws in compliance with federal requirements, potential technology security controls, and failed fiscal management.
The 443-page report found that a number of the failures were tied to the state's controversial UHIP computer system -- the program that the administration of Governor Raimondo has been trying to rebrand it as RIBridges.
The mismanagement of UHIP has led to oversight by the Federal Court to ensure the Raimondo administration complied with federal law.
June 2021 — McKee Signed 3-Year Extension with Deloitte
Since then, the McKee administration has paid Deloitte nearly $150 million: