Penalty Amount
$450,000
Consumers Affected
250,000
Refuah Health Center, Inc. failed to implement adequate data security measures, leading to a ransomware attack that compromised the personal and health information of approximately 250,000 New Yorkers. The New York Attorney General reached a settlement requiring Refuah to invest $1.2 million in cybersecurity improvements and pay $450,000 in penalties.
Refuah must invest $1.2 million to develop and maintain stronger information security programs, implement policies for data access, use multi-factor authentication, rotate credentials, conduct semi-annual audits, encrypt all consumer information, monitor network activity, and maintain an incident response plan. Additionally, Refuah must pay $450,000 in penalties and costs, with $100,000 suspended upon spending the $1.2 million.
In-house legal teams should review all agreements involving the handling of personal and health information, including vendor contracts with IT/cloud service providers, patient consent and authorization forms, and business associate agreements governed by HIPAA. Key clauses to scrutinize are data security standards (mandating encryption, multi-factor authentication, and access controls), breach notification procedures, audit and monitoring rights, and data retention/destruction terms. Given the settlement's focus on inadequate access controls and encryption, contracts must be updated to require specific technical safeguards such as MFA, regular credential rotation, deactivation of inactive accounts, and encryption of sensitive data at rest and in transit. Additionally, ensure agreements include robust incident response obligations, regular security assessments, and clear liability provisions for data breaches.
Entity
Refuah Health Center, Inc.
Also known as: Refuah Health Center
Industry
HealthcareOfficial Press Release
https://ag.ny.gov/press-release/2024/attorney-general-james-reaches-agreement-hudson-valley-health-care-provider
234333689905 l ;!!Ke5ujdWW74OM!8X4rI5 kjU9sT4qUzCgDvY1BmT VY
https://urldefense.com/v3/__https:/lnks.gd/l/eyJhbGciOiJIUzI1NiJ9.eyJidWxsZXRpbl9saW5rX2lkIjoxMDAsInVyaSI6ImJwMjpjbGljayIsInVybCI6Imh0dHBzOi8vYWcubnkuZ292L3NpdGVzL2RlZmF1bHQvZmlsZXMvc2V0dGxlbWVudHMtYWdyZWVtZW50cy9yZWZ1YWgtYW9kLnBkZiIsImJ1bGxldGluX2lkIjoiMjAyNDAxMDUuODgwNTMxOTEifQ.gcJhBDRQpWffjlBV0hxi4SvENil-rBLL9JNIdG4MgBc/s/959752070/br/234333689905-l__;!!Ke5ujdWW74OM!8X4rI5_kjU9sT4qUzCgDvY1BmT-VYUv8vvUuAxj1F_jMrzpyNK8RIx_bYHI-S2UjqLFaoXMTQEZIvmK9FvqTeFXzAjewn2tm00O-R76g$
New York Attorney General Enforcement Page
https://ag.ny.gov/press-releases
"Refuah Health Center, Inc."
"$450,000"
"failed to maintain appropriate controls to protect and limit access to sensitive data"
"compromised the personal and private health information"
$17.1B
Attorney General James and a bipartisan coalition of 50 other attorneys general secured a landmark settlement with Meta Platforms, Inc. (Meta) worth up to $17.1 billion to address the company's harmful and addictive features targeting minors on Facebook and Instagram. The settlement requires Meta to implement significant changes, including age verification, time limits for minors, restrictions on notifications, and options to opt out of algorithmic feeds, along with monetary payments to states for mental health and education programs.
$3.3M
New York Attorney General Letitia James announced a multistate settlement with Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states, pay a combined $3.3 million, and adopt compliance measures to prevent future violations.
$2.0M
New York Attorney General Letitia James, along with four other states and the FTC, settled with Zillow and Redfin after they entered an illegal agreement to stop competing in the multifamily rental advertising market. Zillow paid Redfin $100 million to shut down its advertising business and exclusively display Zillow's listings. The settlement requires the companies to resume competing and pay $2 million.
$400K
New York Attorney General Letitia James secured $400,000 from Thirty Madison, Inc., an online medication provider, for misleading consumers about auto-renewing subscriptions and making cancellation difficult. The company failed to clearly disclose subscription terms and non-refundable fees, and required multiple steps to cancel. The settlement requires payment, refunds to eligible subscribers, and changes to subscription practices.
New York Attorney General Letitia James and a coalition of 22 attorneys general plus Pennsylvania secured a temporary restraining order blocking the Trump administration from seizing the names, dates of birth, and Social Security numbers of 17 million commercial drivers nationwide, including nearly 500,000 New Yorkers. The U.S. District Court for the Eastern District of Virginia granted the TRO, preventing the federal government from accessing the data or cutting off access to the critical database.
$3.3M
New York Attorney General Letitia James announced a bipartisan multistate settlement with major egg producers Cal-Maine Foods, Versova/Centrum, and Hickman's Egg Ranch for illegally coordinating to influence a daily price index for eggs, artificially inflating prices for retailers and consumers nationwide. The companies will deliver 53 million eggs to food banks across 17 participating states (including 4,968,000 eggs to New York) and pay a combined $3.3 million. The companies will also adopt compliance measures to prevent future illegal coordination. Note: This is an antitrust/price-fixing case, not a privacy enforcement action.