Medical services company settles with 4 states over 2023 hack of sensitive patient records
Four US state AGs jointly settled with a healthcare transcription firm over a 2023 patient-data breach — a cross-jurisdiction enforcement model European enterprises should watch as NIS2 coordination matures.
Summary written by editorial AI · Source link below
The case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies.
Editorial Analysis
Coordinated multi-state enforcement against a healthcare data processor previews the kind of joint supervisory actions EU authorities could mount under NIS2, raising the bar for third-party risk management.
Review contracts with healthcare and other sensitive-data processors for breach-notification timelines and liability clauses aligned with current regulatory expectations.
A coordinated multi-state settlement over a healthcare data breach illustrates rising regulatory expectations for third-party data-processing oversight.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at The Record in a new tab.
More from the Compliance Desk
- 3 Frameworks to Protect CISOs & Orgs Against AI Liability27 Oct
- Developing Security Metrics for Automated Compliance Checking26 Oct
- Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads24 Oct
- 23andMe successor settles with California for $6 million over cybersecurity failings20 Oct
- WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators20 Oct