An appellate court has cleared Advocate Medical Group of wrongdoing in a class action lawsuit alleging the organization failed to protect patient data following a massive HIPAA data breach.

The decision, filed August 6 by the Appellate Court of Illinois Second District, affirmed two previous court dismissals of the complaints, which were filed back in September and October 2013. The Chicago-based Advocate Health Care system was hit with a lawsuit led by former patients alleging that they faced "an increased risk of identity theft and/or identity fraud" after four unencrypted AHC laptops containing patient data were stolen from one of its medical facilities July 2013.

[See also: Advocate Health slapped with lawsuit after massive data breach.]

The laptops stole contained the Social Security numbers and protected health information, including medical diagnoses, of 4,029,530, making it the sixth largest HIPAA breach ever reported, according to data from the Department of Health and Human Services.

"We reject plaintiffs' arguments and note again that their allegations are merely speculative," wrote Illinois Appellate Judge Ann B. Jorgensen in the Aug. 6 decision. "The fact that two plaintiffs to date (out of those four million) have received notification of fraudulent activity, i.e., have suffered actual injury arising from Advocate's alleged wrongful acts, does not show that plaintiffs here face imminent, certainly impending, or a substantial risk of harm as a result of the burglary, where no such activity has occurred with respect to their personal data."

[See also: Healthcare's slack security costs $1.6B.]

The appellate panel affirmed two previous court dismissals of the case, both of which argued that there was no "present harm" or that "the harm that Plaintiffs fear is contingent on a chain of attenuated hypothetical events and actions by third parties."

Although considered a win for Advocate Health Care, the financial cost of litigation stemming from the 2013 breach is something to consider.

In fact, organizations can expect to hand over on average a whopping $6.5 million per data breach, according to a 2015 data breach report published by Ponemon Institute and IBM. And healthcare organizations will pay the highest price across 16 industries.