Penalty Amount
$350,000
Consumers Affected
316,845
New York Attorney General Letitia James secured a $350,000 settlement from Personal Touch Holding Corporation for failing to protect patient and employee data. A ransomware attack in January 2021 compromised the personal and medical information of approximately 316,845 New Yorkers due to inadequate security measures. As part of the agreement, Personal Touch must pay penalties, enhance its cybersecurity program, and provide free credit monitoring to affected individuals.
Personal Touch must pay $350,000 in penalties, offer free credit monitoring and identity theft services to affected individuals, and implement a comprehensive information security program including encryption, access controls, employee training, and vendor management procedures.
In-house legal teams should review all agreements involving the handling of sensitive personal or health information, particularly vendor contracts, business associate agreements (BAAs), and data processing addendums. Specific clauses to scrutinize include data security standards (requiring encryption, access controls, and MFA), incident response and breach notification obligations (including timelines and reporting requirements), audit rights for security compliance, and subprocessor management. Given the ransomware attack via a phishing email, contracts must also mandate security awareness training for the vendor's personnel. Changes may be needed to strengthen security obligations, require regular vulnerability assessments and penetration testing, mandate immediate notification of security incidents, and ensure contractual rights to audit or require certification of compliance with frameworks like HIPAA Security Rule. For healthcare data, all BAAs must explicitly incorporate HIPAA Security Rule requirements and hold vendors liable for failures leading to breaches.
Entity
Personal Touch Holding Corporation
Also known as: Personal Touch
Industry
HealthcareOfficial Press Release
https://ag.ny.gov/press-release/2023/attorney-general-james-secures-350000-long-island-home-health-care-company
personal touch aod
https://ag.ny.gov/sites/default/files/settlements-agreements/personal-touch-aod.pdf
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Personal Touch Holding Corporation"
"pay $350,000 in penalties"
"Health Insurance Portability and Accountability Act (HIPAA)"
"failing to protect vulnerable New Yorkers’ personal information and health care data"
New York Attorney General Letitia James obtained a temporary restraining order from the U.S. District Court for the Northern District of California blocking Paramount Skydance Corp.'s proposed $110 billion merger with Warner Bros. Discovery, Inc. The lawsuit alleges the merger would illegally reduce competition in film and television, leading to higher prices and fewer choices for consumers.
$18.0M
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
New York Attorney General Letitia James and 11 other attorneys general filed a lawsuit to block the proposed $110 billion merger between Paramount Skydance Corp. and Warner Bros. Discovery, Inc., alleging the merger would violate antitrust law by reducing competition in theatrical film releases and basic cable television markets, leading to higher prices for consumers and fewer diverse entertainment options.
New York Attorney General Letitia James sued 3M, DuPont, and other chemical companies for knowingly causing decades of PFAS pollution through consumer products. The lawsuit alleges the companies hid toxicity risks, failed to warn the public, and seeks cleanup funding, damages, and injunctive relief.
New York Attorney General Letitia James joined a bipartisan coalition of 48 other attorneys general in submitting comments to the FCC urging stronger rules to combat illegal robocalls. The coalition recommends expanding the definition of telephone number resellers, prohibiting resale of certain numbers, and requiring mandatory education for companies selling phone numbers. This is a regulatory advocacy action, not a direct enforcement action against a specific company.
New York Attorney General Letitia James issued guidance to New Yorkers donating to Venezuela earthquake relief, warning about fraudulent charities and scams. The guidance provides tips on verifying charities, avoiding phishing, and reporting suspicious organizations.