Penalty Amount
$450,000
Consumers Affected
250,000
Refuah Health Center, Inc. failed to implement adequate data security measures, leading to a ransomware attack that compromised the personal and health information of approximately 250,000 New Yorkers. The New York Attorney General reached a settlement requiring Refuah to invest $1.2 million in cybersecurity improvements and pay $450,000 in penalties.
Refuah must invest $1.2 million to develop and maintain stronger information security programs, implement policies for data access, use multi-factor authentication, rotate credentials, conduct semi-annual audits, encrypt all consumer information, monitor network activity, and maintain an incident response plan. Additionally, Refuah must pay $450,000 in penalties and costs, with $100,000 suspended upon spending the $1.2 million.
In-house legal teams should review all agreements involving the handling of personal and health information, including vendor contracts with IT/cloud service providers, patient consent and authorization forms, and business associate agreements governed by HIPAA. Key clauses to scrutinize are data security standards (mandating encryption, multi-factor authentication, and access controls), breach notification procedures, audit and monitoring rights, and data retention/destruction terms. Given the settlement's focus on inadequate access controls and encryption, contracts must be updated to require specific technical safeguards such as MFA, regular credential rotation, deactivation of inactive accounts, and encryption of sensitive data at rest and in transit. Additionally, ensure agreements include robust incident response obligations, regular security assessments, and clear liability provisions for data breaches.
Entity
Refuah Health Center, Inc.
Also known as: Refuah Health Center
Industry
HealthcareOfficial Press Release
https://ag.ny.gov/press-release/2024/attorney-general-james-reaches-agreement-hudson-valley-health-care-provider
234333689905 l ;!!Ke5ujdWW74OM!8X4rI5 kjU9sT4qUzCgDvY1BmT VY
https://urldefense.com/v3/__https:/lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vYWcubnkuZ292L3NpdGVzL2RlZmF1bHQvZmlsZXMvc2V0dGxlbWVudHMtYWdyZWVtZW50cy9yZWZ1YWgtYW9kLnBkZiIsImJ1bGxldGluX2lkIjoiMjAyNDAxMDUuODgwNTMxOTEifQ.gcJhBDRQpWffjlBV0hxi4SvENil-rBLL9JNIdG4MgBc/s/959752070/br/234333689905-l__;!!Ke5ujdWW74OM!8X4rI5_kjU9sT4qUzCgDvY1BmT-VYUv8vvUuAxj1F_jMrzpyNK8RIx_bYHI-S2UjqLFaoXMTQEZIvmK9FvqTeFXzAjewn2tm00O-R76g$
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Refuah Health Center, Inc."
"$450,000"
"failed to maintain appropriate controls to protect and limit access to sensitive data"
"compromised the personal and private health information"
New York Attorney General Letitia James obtained a temporary restraining order from the U.S. District Court for the Northern District of California blocking Paramount Skydance Corp.'s proposed $110 billion merger with Warner Bros. Discovery, Inc. The lawsuit alleges the merger would illegally reduce competition in film and television, leading to higher prices and fewer choices for consumers.
$18.0M
New York Attorney General Letitia James and a bipartisan coalition of 42 other attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' private genetic data. The October 2023 data breach exposed sensitive genetic information of 6.9 million consumers, including 305,245 in New York, with some data published for sale on the dark web. The settlement includes monetary penalties and new data protection requirements for the company and its successor, 23andMe Research Institute.
New York Attorney General Letitia James and 11 other attorneys general filed a lawsuit to block the proposed $110 billion merger between Paramount Skydance Corp. and Warner Bros. Discovery, Inc., alleging the merger would violate antitrust law by reducing competition in theatrical film releases and basic cable television markets, leading to higher prices for consumers and fewer diverse entertainment options.
New York Attorney General Letitia James sued 3M, DuPont, and other chemical companies for knowingly causing decades of PFAS pollution through consumer products. The lawsuit alleges the companies hid toxicity risks, failed to warn the public, and seeks cleanup funding, damages, and injunctive relief.
New York Attorney General Letitia James joined a bipartisan coalition of 48 other attorneys general in submitting comments to the FCC urging stronger rules to combat illegal robocalls. The coalition recommends expanding the definition of telephone number resellers, prohibiting resale of certain numbers, and requiring mandatory education for companies selling phone numbers. This is a regulatory advocacy action, not a direct enforcement action against a specific company.
New York Attorney General Letitia James issued guidance to New Yorkers donating to Venezuela earthquake relief, warning about fraudulent charities and scams. The guidance provides tips on verifying charities, avoiding phishing, and reporting suspicious organizations.