Unencrypted medical data leads to 12-state litigation