Penalty Amount
$495,000
Consumers Affected
14,663
The New Jersey Attorney General settled with Diamond Institute for Infertility and Menopause, LLC, following a data breach that exposed the electronic protected health information (ePHI) of 14,663 patients. The investigation found the clinic failed to implement required HIPAA Security Rule safeguards, including risk assessments, encryption, and access controls. The $495,000 settlement includes civil penalties and requires the clinic to implement a comprehensive information security program and corrective actions.
Diamond must pay $495,000 ($412,300 in civil penalties and $82,700 in costs/fees). The settlement mandates the development and implementation of a comprehensive information security program, appointment of a qualified HIPAA Privacy and Security Officer, employee training, a written incident response plan, and specific technical safeguards including encryption, logging, access controls, risk assessments, and password management.
In-house legal teams should review vendor agreements (especially Business Associate Agreements under HIPAA), customer/patient service agreements, and employee access policies. Key clauses to scrutinize include data security requirements (encryption, access controls), breach notification timelines and procedures, audit and monitoring rights, and corrective action plan obligations. Given the settlement's focus on inadequate risk assessments and encryption, contracts should be updated to mandate regular security risk assessments, specify encryption standards for ePHI, require prompt breach reporting consistent with NJ and HIPAA timelines, and include enforceable remedies for security failures.
Entity
Diamond Institute for Infertility and Menopause, LLC
Also known as: Diamond Institute for Infertility and Menopause
Industry
HealthcareOfficial Press Release
https://www.njoag.gov/acting-ag-bruck-announces-settlement-with-fertility-clinic-over-cybersecurity-lapses-and-data-breach/
Diamond Institute
https://www.nj.gov/oag/newsreleases21/Diamond-Institute.pdf
New Jersey Attorney General Enforcement Page
https://www.njoag.gov/about/divisions-and-offices/division-of-consumer-affairs/
"Diamond Institute for Infertility and Menopause, LLC (“Diamond”)"
"The settlement of $495,000 includes $412,300 in civil penalties and $82,700 in investigative costs and attorneys’ fees."
"failing to conduct an accurate and thorough risk assessment of potential risk and vulnerabilities to the confidentiality, integrity and availability of ePHI; failing to implement a mechanism to encrypt ePHI; failing to review and modify security measures as needed to continue reasonable and appropriate protection of ePHI; failing to implement proper procedures for creating, changing, and safeguarding passwords; and failing to implement procedures to verify that the person seeking access to ePHI is who they claim to be."
"compromised the personal information of 14,663 patients, including 11,071 New Jersey residents."
"developing and implementing a comprehensive information security program that includes regular updates to keep pace with changes in technology and security threats; appointing a new HIPAA Privacy and Security Officer... training employees... developing and implementing a written incident response and data breach notification plan... implementing personal information safeguards and controls, including encryption, logging and monitoring, access controls, a risk assessment program, and password management."
"violated the New Jersey Consumer Fraud Act, the federal Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule, and the HIPAA Security Rule"
$18.0M
Attorney General Jennifer Davenport joined a bipartisan coalition of 42 attorneys general in announcing a settlement with the bankruptcy trustee for 23andMe, resolving allegations from a 2023 data breach that compromised genetic data of 6.9 million people worldwide, including nearly 150,000 in New Jersey. The settlement provides $18 million to states from available bankruptcy funds, plus enhanced data security and consumer deletion rights for the successor entity, 23andMe Research Institute.
$45.0M
Block, Inc. agreed to a $45 million multistate settlement with 46 states for allegedly misleading consumers about the safety of Cash App, failing to protect users from fraud, and not providing promised fraud protection. The settlement requires Block to improve customer support, stop misleading claims, and educate consumers about fraud.
Attorney General Jennifer Davenport co-led a coalition of 49 attorneys general in calling on the FCC to strengthen rules to cut off scammers' access to legitimate telephone numbers. The coalition's letter requests stronger certification rules, regular reporting, and prohibitions on number cycling to combat illegal robocalls.
Governor Sherrill and Attorney General Davenport announced coordinated executive actions to reduce and eliminate junk fees in New Jersey. The initiative includes an Executive Order directing state agencies to review industries for junk fees and an Enforcement Statement from the Division of Consumer Affairs explaining how junk fee practices may violate the New Jersey Consumer Fraud Act.
The New Jersey Bureau of Securities announced its 2026 annual investment adviser examination, with a particular focus on firms' use of artificial intelligence and cybersecurity protocols. The examination requires nearly 800 registered investment adviser firms to answer questions about AI use in portfolio management, data protection policies, and third-party vendor due diligence. Failure to comply may result in administrative action.
The New Jersey Bureau of Securities filed a lawsuit against Xiao Hu (aka Mark Hu) and his companies Skyline Technology USA LLC and Thunderbirds.ME, Inc. for allegedly defrauding at least 15 investors out of $2.5 million through unregistered securities offerings. Hu allegedly misappropriated at least $280,000 for personal expenses including a home purchase and vacation, and falsely claimed to have a Ph.D. from Columbia University.