Careers

Experiences

Industries

Offices

Our Firm

Pages

Our People

Updates

Practices

Warner Norcross + Judd LLP is a corporate law firm with over 230 attorneys serving clients in nine offices throughout Michigan. Among the largest law firms in Michigan, Warner works in virtually all areas of business law.

Michigan Law Firm - Warner Norcross + Judd LLP

Earlier this year, the U.S. Department of Justice (DOJ) announced Illumina Inc. agreed to pay&nbsp;$9.8 million&nbsp;to resolve allegations under the False Claims Act (FCA) relating to cybersecurity vulnerabilities in its genomic sequencing systems sold to federal agencies. This resolution signals an intensifying DOJ focus on cybersecurity compliance — especially for companies whose products or services are purchased by the government. For healthcare entities, which often straddle both private and public sectors, the Illumina case offers important lessons.

core/paragraph

According to the DOJ, between February 2016 and September 2023, Illumina sold genomic sequencing systems to government agencies with software that had known cybersecurity vulnerabilities. The government alleged Illumina had inadequate security programs, lacked sufficient design and development controls around cybersecurity and failed to monitor systems in the field to detect or remediate vulnerabilities. Illumina also allegedly misrepresented that its software complied with recognized cybersecurity standards, including International Organization for Standardization (ISO) and National Institute of Standards and Technology (NIST) standards.

The case originated as a qui tam/whistleblower suit filed by a former director, and the whistleblower will receive $1.9 million as part of the settlement. Importantly, this case is not confined to a niche area of life sciences; it underscores that cybersecurity diligence is material in procurement and contracting contexts, and lapses or misrepresentations may trigger FCA risks.

Health care entities — especially those involved in government-funded programs, research grants, partnerships or devices/software procurement — should understand how the Illumina settlement may foreshadow regulatory and enforcement trends:

Cybersecurity as a contractual (or implied) obligation: Even if not explicitly stated, government contracts or grants may carry implicit expectations (or future regulation) that purchased systems, software or services adhere to cybersecurity standards (e.g., NIST, Cybersecurity Maturity Model Certification). The DOJ is now treating failure in this respect as potential FCA exposure. Importantly, this case did not rely on a data security breach. The government’s claims relied on latent defects in the product.

core/list-item

Increased FCA risk tied to misrepresentations and claims of compliance: In Illumina’s case, allegations turned on alleged misrepresentations of compliance. Health care providers or vendors who assert compliance with security or privacy standards (Health Insurance Portability and Accountability Act, Health Information Technology for Economic and Clinical Health, NIST, etc.) in proposals or claims must ensure those assertions are accurate and supported.

Supply chain and vendor oversight pressure: The vulnerabilities in Illumina’s product highlight downstream risk: If a health care provider relies on vendor-supplied systems or software (e.g., for diagnostics, genomics, imaging or medical devices), insufficient due diligence or poor vendor cybersecurity controls may become a target of regulatory scrutiny.

Whistleblower/FCA enforcement is alive and well in cyber/privacy space: The use of a qui tam action in this context signals that insiders may increasingly target cybersecurity lapses via FCA channels, beyond traditional billing fraud cases.

Reputational, operational and financial risk: While $9.8 million is significant in isolation, exposure, remediation costs, reputational damage and potential exclusion from federal contracting can compound losses — especially for health care entities reliant on government funding or contracts.

core/list

As we noted <a href="https://www.wnj.com/updates/avoid-the-october-surprise-what-you-need-to-know-about-dojs-new-data-security-program/" target="_blank" rel="noreferrer noopener">earlier this year</a>, the DOJ is increasingly concerned about the protection of sensitive data. Looking ahead, expect further civil cyber-fraud enforcement actions, particularly in sectors that receive significant federal funding (health care, life sciences, defense and research). Companies should anticipate tighter contractual clauses from federal agencies demanding explicit cybersecurity requirements, audit rights and liability triggers. We are monitoring whether similar enforcement arises in the health care device/software sector (e.g., imaging, diagnostic tools, medical IoT).

The Illumina settlement reinforces the message that cybersecurity is no longer “nice to have.” Rather, it is a material obligation in government procurement and grants. Health care organizations, in particular, must be proactive in managing cybersecurity risk across systems, supply chains, contracts and operations. Warner has experienced attorneys to help you assess your vendor contracts, policies, documentation or readiness programs in light of this development.

Please contact Nate Steed, Katie Pullen, Jeff Segal, Mike Stone, Adam Townshend, Adam Bruski or your Warner attorney for more information.

Health Care

Senior Counsel

Adam D. Bruski

Partner

Katherine L. “Katie” Pullen

Jeffrey S. “Jeff” Segal

Nathan W. “Nate” Steed

Michael A. “Mike” Stone

Adam B. Townshend

Cybersecurity and Privacy

DOJ Forces $9.8 Million Settlement with Illumina over Cybersecurity Failures: Key Takeaways for Health Care Providers

Warner Norcross + Judd LLP is responsible for the contents of our advertising and this website. Please read our full <a href="/privacy-policy/" aria-label="see privacy policy">privacy policy</a> available on our website. If you have any questions or comments about our website or our Privacy Policy please contact us at <a href="mailto:info@wnj.com">info@wnj.com</a> or 616.752.2000.

DOJ Forces $9.8 Million Settlement with Illumina over Cybersecurity Failures: Key Takeaways for Health Care Providers

professionals