1,285 enforcement actions from 14 federal and state jurisdictions. Every event traced back to its official government source.
1,285
Total Actions
14
Jurisdictions
$35.3B+
Total Fines Tracked
River Region Cardiology (Healthcare Provider, AL) reported a HIPAA breach affecting 48,600 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Community Connections (Healthcare Provider, DC) reported a HIPAA breach affecting 18,949 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
New York Attorney General Letitia James secured a $550,000 settlement from Hudson Valley health care operator HealthAlliance over a 2023 data breach that compromised the personal and medical information of 242,641 New Yorkers. The breach occurred after HealthAlliance failed to patch a known vulnerability in its web application system, allowing cyberattackers to exfiltrate patient and employee data. As part of the settlement, HealthAlliance must pay the penalty and implement enhanced cybersecurity measures including a comprehensive security program, patch management policy, and data inventory requirements.
$550K
Conceptions Reproductive Associates of Colorado (Healthcare Provider, CO) reported a HIPAA breach affecting 80,000 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
East Central Missouri Behavioral Health Services, Inc. (Healthcare Provider, MO) reported a HIPAA breach affecting 20,000 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
AuthoraCare Collective (Healthcare Provider, NC) reported a HIPAA breach affecting 57,944 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Network Server.
ESHA, Inc. (Business Associate, TX) reported a HIPAA breach affecting 76,922 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
New York Attorney General Letitia James reached a $250,000 settlement with National Amusements, Inc. after an investigation found the movie theater operator failed to implement adequate data security, leading to a breach exposing personal information of over 23,000 New York employees. The company also violated the New York Shield Act by delaying notification to affected individuals for more than a year after the breach. As part of the settlement, National Amusements must pay the penalty and implement enhanced cybersecurity measures including encryption, password policies, and an incident response plan.
$250K
Radiologic Medical Services, P.C. (Healthcare Provider, IA) reported a HIPAA breach affecting 56,902 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
South West Family Medicine Associates, PA (Healthcare Provider, TX) reported a HIPAA breach affecting 36,959 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
New York Attorney General Letitia James reached a settlement with Albany ENT & Allergy Services (AENT) over two 2023 ransomware attacks that compromised the medical records of over 200,000 New Yorkers. The OAG found AENT failed to maintain reasonable data security safeguards, inadequately oversaw third-party security vendors, and initially failed to disclose all exposed consumer data to the state. AENT will pay $1 million in penalties (with $500,000 suspended pending $2.25 million in security investments) and implement comprehensive data security measures including encryption, multi-factor authentication, and vendor oversight.
$1.0M
Hawaii Radiologic Associates, Ltd. (Healthcare Provider, HI) reported a HIPAA breach affecting 23,205 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Gandara Mental Health Center (Healthcare Provider, MA) reported a HIPAA breach affecting 20,024 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Guardian Analytics, Inc. and Actimize, Inc. settled with the Connecticut Attorney General over a data breach affecting 157,629 Connecticut residents. The breach, from November 2022 to January 2023, exposed personal information due to security failures. The settlement includes a $500,000 penalty and mandatory cybersecurity improvements.
$500K
Clay Platte Family Medicine (Healthcare Provider, MO) reported a HIPAA breach affecting 53,916 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Advanced Recovery Equipment & Supplies, LLC (Healthcare Provider, NY) reported a HIPAA breach affecting 56,000 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Valleygate Dental Surgery Centers of Charlotte, Fayetteville, and the West, LLC. (Healthcare Provider, NC) reported a HIPAA breach affecting 14,589 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Wilmington Community Clinic (Healthcare Provider, CA) reported a HIPAA breach affecting 11,601 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Dr. Daniel J. Leeman, M.D. (Healthcare Provider, TX) reported a HIPAA breach affecting 50,000 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Asheville Arthritis and Osteoporosis Center, P.A. (Healthcare Provider, NC) reported a HIPAA breach affecting 58,251 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Atrium Health (Healthcare Provider, NC) reported a HIPAA breach affecting 32,120 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Pomona Community Health Center dba ParkTree Community Health Center (Healthcare Provider, CA) reported a HIPAA breach affecting 40,964 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Contents Trader, Inc. (Healthcare Provider, TX) reported a HIPAA breach affecting 27,329 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Network Server.
Pemiscot Memorial Health System (Healthcare Provider, MO) reported a HIPAA breach affecting 33,279 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Electronic Medical Record.
Gramercy Surgery Center, Inc. (Healthcare Provider, NY) reported a HIPAA breach affecting 52,372 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Turning Point of Central California, Inc. (Healthcare Provider, CA) reported a HIPAA breach affecting 53,737 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Pocahontas Medical Clinic, PA (Healthcare Provider, AR) reported a HIPAA breach affecting 31,216 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Surgery Center of Mid Florida (Healthcare Provider, FL) reported a HIPAA breach affecting 48,684 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Community Counseling of Bristol County, Inc. (Healthcare Provider, MA) reported a HIPAA breach affecting 44,991 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
NGL Labs, LLC and its founders were sued by the FTC and Los Angeles DA for marketing an anonymous messaging app to children and teens, making false claims about AI content moderation, sending fake messages to boost engagement, and violating COPPA by collecting kids' data without parental consent. They must pay $5 million, with $500,000 as a civil penalty and $4.5 million for consumer redress, and are banned from offering the app to users under 18. The order requires age gates, data deletion, and prohibits false claims about AI and recurring charges.
$500K
All data sourced from official government enforcement pages.