1,711 enforcement actions from 16 federal and state jurisdictions. Every event traced back to its official government source.
1,711
Total Actions
16
Jurisdictions
$51.3B+
Total Fines Tracked
New York and Connecticut reached a settlement with Boston Children’s Health Physicians and its IT security provider, XTIUM, after a 2024 breach exposed private information of approximately 825,000 New York residents and 62,871 Connecticut residents. The companies will pay $2.64 million and implement enhanced cybersecurity measures; additional penalties are conditional on violating the settlement.
$2.6M
Connecticut and New York found that Boston Children’s Health Physicians and its security vendor, XTIUM, failed to use reasonable safeguards, resulting in hackers accessing sensitive personal, medical, and employee information. The companies agreed to pay penalties totaling $2.64 million and implement enhanced cybersecurity measures.
$2.6M
New York and a coalition of 47 other attorneys general secured settlements with Ascend Laboratories and Mayne Pharma over an alleged scheme to inflate generic drug prices and reduce competition. Mayne agreed to pay $650,000 and Ascend $400,000, with settlement funds distributed to impacted consumers and the companies agreeing to internal antitrust reforms.
$1.1M
Connecticut Attorney General William Tong led a coalition of 45 states and territories seeking court approval for settlements resolving allegations that Ascend Laboratories, Citron Pharma, and Mayne Pharma conspired to inflate prices and limit competition for generic prescription drugs. Ascend agreed to pay $400,000, Mayne agreed to pay $650,000, and Citron’s settlement includes non-monetary terms; the companies also agreed to internal reforms.
$1.1M
Texas Attorney General Ken Paxton announced a $7.5 million settlement with Tris Pharmaceuticals over alleged misrepresentations about the efficacy of Dyanavel XR, an ADHD drug marketed for children. The release says the company overstated the drug’s efficacy and directed sales representatives to make misleading claims to doctors, including Medicaid providers.
$7.5M
New York and a bipartisan coalition of 43 other attorneys general reached an agreement with Laboratory Corporation of America (Labcorp) following a 2019 breach at its debt-collection vendor, AMCA, that potentially exposed personal information of more than 27.5 million people. Labcorp will pay $2,287,455 to the states and implement extensive security and vendor-risk reforms.
$2.3M
Connecticut Attorney General William Tong led a 44-attorney-general coalition settlement with Laboratory Corporation of America over the 2019 AMCA breach, which potentially exposed personal information of more than 27.5 million people, including 10.2 million Labcorp patients. Labcorp will pay $2,287,455 and implement enhanced vendor-risk management, information-security, and oversight measures.
$2.3M
Colorado and a bipartisan coalition of attorneys general reached a $2,287,455 settlement with Laboratory Corporation of America over the 2019 data breach at its debt collector, American Medical Collection Agency. The settlement requires stronger vendor risk management and information security practices, with particular requirements for medical debt collectors.
$2.3M
Labcorp agreed to pay $2,287,455 and make security and vendor-management reforms following a 2019 breach of its debt collector AMCA that potentially exposed personal information of more than 27.5 million people, including Labcorp patients’ sensitive medical information. The settlement requires stronger security and incident response practices, limits on vendor data sharing, enhanced vendor oversight, contractual cybersecurity requirements, and an independent security assessment.
$2.3M
Laboratory Corporation of America Holdings agreed to pay $2,287,455 to participating states and strengthen its security and vendor-management practices following an investigation into the 2019 breach at its debt-collection vendor, AMCA. The breach potentially exposed information of more than 27.5 million people nationwide, including sensitive information belonging to approximately 10.2 million LabCorp patients.
$2.3M
Minnesota Attorney General Keith Ellison reached a settlement with Stevens Community Medical Center (SCMC) over allegations that SCMC improperly calculated discounts required for uninsured patients with household incomes under $125,000, violating the Minnesota Hospital Agreement and state law. As a result, some uninsured patients were billed up to 20.5% more than allowed. SCMC must provide up to $1,412,776.25 in refunds or medical-debt reductions to potentially eligible patients.
$1.4M
Attorney General Phil Weiser joined a bipartisan coalition of 48 states and territories in announcing a $29.6 million settlement with Glenmark Pharmaceuticals. The settlement resolves allegations that Glenmark participated in a widespread conspiracy to inflate prices, reduce competition, and restrain trade for numerous generic prescription drugs. Glenmark also agreed to cooperate in ongoing multistate litigation and implement internal reforms.
$29.6M
Colorado Attorney General Phil Weiser and a bipartisan coalition of 18 attorneys general announced a $4.87 million settlement with GS Labs, a former COVID-19 rapid testing business. The company was found to have violated the Colorado Consumer Protection Act by falsely advertising test results with no wait times, same day appointments, and no out-of-pocket expenses, while overcharging consumers and insurance providers.
$4.9M
ApolloMD Business Services, LLC (Business Associate, GA) reported a HIPAA breach affecting 626,540 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Telemarketing enforcement case where the FTC obtained a temporary restraining order against defendants who deceptively marketed limited benefit health plans as comprehensive health insurance. The scheme caused tens of millions of dollars in harm to consumers seeking health coverage. The court halted operations at the FTC's request.
Minnesota Department of Human Services (Health Plan, MN) reported a HIPAA breach affecting 303,965 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Network Server.
Illinois Department of Human Services (Health Plan, IL) reported a HIPAA breach affecting 705,017 individuals. Breach type: Unauthorized Access/Disclosure. Location of breached information: Network Server.
Fieldtex Products, Inc. (Business Associate, NY) reported a HIPAA breach affecting 104,071 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Richmond Behavioral Health Authority (Healthcare Provider, VA) reported a HIPAA breach affecting 113,232 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Persante Health Care (Business Associate, NJ) reported a HIPAA breach affecting 111,815 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
VITAS Hospice Services, LLC (Healthcare Provider, FL) reported a HIPAA breach affecting 319,177 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Delta Dental of Virginia (Health Plan, VA) reported a HIPAA breach affecting 126,953 individuals. Breach type: Hacking/IT Incident. Location of breached information: Email.
Fieldtex Products, Inc. (Business Associate, NY) reported a HIPAA breach affecting 238,615 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Denton MHMR Center (Healthcare Provider, TX) reported a HIPAA breach affecting 108,967 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Expert MRI (Healthcare Provider, CA) reported a HIPAA breach affecting 209,560 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Tri Century Eye Care PC (Healthcare Provider, PA) reported a HIPAA breach affecting 200,000 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Northwest Radiologists, Inc./Mount Baker Imaging (Healthcare Provider, WA) reported a HIPAA breach affecting 362,713 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Modernizing Medicine, Inc. (Business Associate, FL) reported a HIPAA breach affecting 198,795 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Brightstar Global Solutions Corporation (Health Plan, RI) reported a HIPAA breach affecting 103,879 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
Harbor (Healthcare Provider, OH) reported a HIPAA breach affecting 216,000 individuals. Breach type: Hacking/IT Incident. Location of breached information: Network Server.
All data sourced from official government enforcement pages.