State Attorneys General HIPAA Enforcement Overview: Penalties and Trends 2010-2026, Including Comstar and Orthopedics NY
State attorneys general share HIPAA enforcement with the HHS Office for Civil Rights (OCR) under authority granted by the HITECH Act. The first action came in 2010, when the Connecticut AG settled with Health Net for $250,000. Enforcement peaked in 2023 with 16 actions, including a $49.5 million penalty against Blackbaud over a 5.5 million-record breach. It dropped to a single penalty in 2025 (Orthopedics NY, $500,000, 656,086 individuals affected). In 2026 the Massachusetts AG, assisted by Connecticut, fined Comstar $515,000 over a breach affecting 585,621 individuals. OCR separately fined Comstar $75,000 for failing to conduct a risk assessment.
Detalhes técnicos
- Multistate actions let AGs pool resources. Examples are the 49-state Blackbaud action, the 32-state Personal Touch Home Care action and the 4-state EyeMed Vision Care action (2023).
- In 2024 there were 9 actions and $19.56 million in fines. New York was the most active, with four settlements. The largest penalty was $4.5 million against Enzo Biochem/Enzo Clinical Labs (NY, NJ, CT).
- Albany ENT & Allergy Services was fined $1 million ($500,000 suspended) and must invest $2.25 million in cybersecurity. Refuah Health Center paid $450,000 and must invest $1.2 million.
- The 2021 AMCA case carried a $21 million penalty, suspended because of the company's bankruptcy.
- Some AG actions are brought under equivalent state laws rather than HIPAA itself.
- Community Health Systems/CHSPSC, Anthem, Premera Blue Cross, Aetna, Cottage Health, University of Rochester Medical Center and Medical Informatics Engineering settled with both OCR and state AGs.
Remediação
Covered entities and business associates should conduct and document enterprise-wide risk assessments, since the lack of one was cited in the Comstar OCR action. They should also encrypt devices holding ePHI and meet breach notification deadlines. Entities should expect parallel federal and state exposure after a breach.
Linha do tempo
-
State Attorneys General HIPAA Enforcement Overview: Penalties and Trends 2010-2026, Including Comstar and Orthopedics NY
ler a análise desta fonte ocultar
State attorneys general share HIPAA enforcement with the HHS Office for Civil Rights (OCR) under authority granted by the HITECH Act. The first action came in 2010, when the Connecticut AG settled with Health Net for $250,000. Enforcement peaked in 2023 with 16 actions, including a $49.5 million penalty against Blackbaud over a 5.5 million-record breach. It dropped to a single penalty in 2025 (Orthopedics NY, $500,000, 656,086 individuals affected). In 2026 the Massachusetts AG, assisted by Connecticut, fined Comstar $515,000 over a breach affecting 585,621 individuals. OCR separately fined Comstar $75,000 for failing to conduct a risk assessment.
Technical Details
- Multistate actions let AGs pool resources. Examples are the 49-state Blackbaud action, the 32-state Personal Touch Home Care action and the 4-state EyeMed Vision Care action (2023).
- In 2024 there were 9 actions and $19.56 million in fines. New York was the most active, with four settlements. The largest penalty was $4.5 million against Enzo Biochem/Enzo Clinical Labs (NY, NJ, CT).
- Albany ENT & Allergy Services was fined $1 million ($500,000 suspended) and must invest $2.25 million in cybersecurity. Refuah Health Center paid $450,000 and must invest $1.2 million.
- The 2021 AMCA case carried a $21 million penalty, suspended because of the company's bankruptcy.
- Some AG actions are brought under equivalent state laws rather than HIPAA itself.
- Community Health Systems/CHSPSC, Anthem, Premera Blue Cross, Aetna, Cottage Health, University of Rochester Medical Center and Medical Informatics Engineering settled with both OCR and state AGs.
Remediation
Covered entities and business associates should conduct and document enterprise-wide risk assessments, since the lack of one was cited in the Comstar OCR action. They should also encrypt devices holding ePHI and meet breach notification deadlines. Entities should expect parallel federal and state exposure after a breach.