Medical services company settles with 4 states over 2023 hack of sensitive patient records
Four US state AGs jointly settled with a healthcare transcription firm over a 2023 patient-data breach — a cross-jurisdiction enforcement model European enterprises should watch as NIS2 coordination matures.
Summary written by editorial AI · Source link below
The case, brought by AGs in Connecticut, New Jersey, New York and Michigan, targeted the medical transcription, coding and imaging subsidiaries of the Nevada-based Perry Johnson Companies.
Editorial Analysis
Framed for the Compliance & GRC desk
Multi-state enforcement against a healthcare BPO for a 2023 breach signals that regulators are increasingly coordinating across jurisdictions, a pattern EU DPAs may replicate under NIS2.
Audit third-party medical-data processors for encryption-at-rest, access logging, and breach-notification SLAs to pre-empt similar coordinated regulatory action.
A coordinated multi-state settlement over a healthcare data breach illustrates rising regulatory expectations for third-party data-processing oversight.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at The Record in a new tab.
More from the Compliance Desk
- 3 Frameworks to Protect CISOs & Orgs Against AI Liability27 Oct
- Developing Security Metrics for Automated Compliance Checking26 Oct
- Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads24 Oct
- 23andMe successor settles with California for $6 million over cybersecurity failings20 Oct
- WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators20 Oct