State attorneys general HIPAA enforcement is accelerating, with multistate actions and penalties in the millions, adding a second front of HIPAA risk beyond federal oversight.
This analysis draws on the HIPAA Journal's running tracker of HIPAA enforcement by state attorneys general, available at https://www.hipaajournal.com/hipaa-enforcement-by-state-attorneys-general/. It matters to covered entities and business associates of every size: physician practices, health systems, billing vendors, and the service providers that hold electronic protected health information on their behalf.
Key Takeaways
- The HITECH Act gave state attorneys general the authority to bring civil actions on behalf of state residents harmed by violations of the HIPAA Privacy and Security Rules, and to obtain damages for those residents.
- State AG enforcement was rare in the early years, with only 11 settlements between 2010 and 2015, but stepped up sharply with 5 settlements in 2017 and 12 in 2018.
- Multistate actions are now the pattern: four of five financially penalized cases in 2019 and 2020 were multistate, and 2023 included a 49-state action against Blackbaud that produced a $49.5 million penalty.
- State AG actions are separate from Office for Civil Rights actions. Comstar paid $515,000 to settle with state attorneys general and was also fined $75,000 by OCR for the same breach.
- Penalties are not the only cost. New York settlements in 2024 required Albany ENT & Allergy Services to invest $2.25 million in cybersecurity and Refuah Health Center to invest $1.2 million, on top of financial penalties.
What Happened: The Facts in Detail
The legal foundation: HITECH and the first cases
The Department of Health and Human Services' Office for Civil Rights is the main enforcer of HIPAA compliance, but it is not the only one. The HITECH Act gave state attorneys general the authority to bring civil actions on behalf of state residents impacted by violations of the HIPAA Privacy and Security Rules, and to obtain damages on their behalf.
Connecticut's Attorney General was the first to exercise that right, in 2010, against Health Net Inc. over the loss of an unencrypted hard drive containing the electronic protected health information of 1.5 million individuals and delayed breach notifications. That case settled for $250,000. Vermont followed with a similar action against Health Net in 2011, settled for $55,000, and Indiana brought a civil action against Wellpoint Inc. in 2011, settled for $100,000.
From rare actions to a steady enforcement rhythm
For the first several years, state attorneys general HIPAA cases were relatively rare: only 11 settlements were reached with HIPAA-covered entities and business associates between 2010 and 2015. Enforcement stepped up in 2017 with 5 settlements, and again in 2018 when 12 cases resulted in financial penalties.
In 2019 and 2020, a total of just 5 cases resulted in financial penalties, but four of the five were multistate actions against covered entities and business associates in which several state attorneys general participated. These multistate actions allow attorneys general to pool resources and investigate potential violations of HIPAA and state laws more efficiently.
2023: the busiest year on record
2023 saw 16 enforcement actions resolving violations of the HIPAA Rules and state consumer protection and breach notification laws. Cases were resolved by the attorneys general of California, Colorado, Indiana, New York, Ohio, and Pennsylvania. Three multistate investigations were resolved, including a 49-state action against Blackbaud over its 5.5 million-record breach, which resulted in a $49.5 million penalty. There was also a 32-state action against Personal Touch Home Care and a 4-state action against EyeMed Vision Care.
2024: fewer cases, larger penalties, mandated security spending
In 2024, there were 9 enforcement actions by attorneys general in five U.S. states, with a total of $19,560,000 in fines imposed. New York was the most active with four settlements, followed by California with three. A multistate investigation involving New York, New Jersey, and Connecticut against Enzo Biochem/Enzo Clinical Labs produced a $4,500,000 financial penalty, the largest of the year imposed by state attorneys general.
Two New York actions paired penalties with required cybersecurity investments. Albany ENT & Allergy Services was fined $1 million, of which $500,000 was suspended, and was required to invest $2.25 million in cybersecurity. Refuah Health Center paid a $450,000 penalty and was required to invest $1.2 million in cybersecurity.
2025 and 2026: New York stays active, Massachusetts enters
After two years of strong enforcement, only one financial penalty was imposed in 2025, and it was New York again: Orthopedics NY was fined $500,000 over a data breach affecting 656,086 individuals, with the investigation uncovering multiple cybersecurity failures that led to the breach.
2026 has started with an early action by the Massachusetts Attorney General, assisted by the Connecticut Attorney General. Comstar was fined $515,000 for a breach affecting 585,621 individuals, including 326,426 Massachusetts residents and 22,829 Connecticut residents.
Two enforcers, one breach
The Comstar matter illustrates the dual-exposure problem. State attorneys general actions are separate from any Office for Civil Rights actions, which may independently investigate and impose their own fines. Comstar was fined $75,000 by OCR, which determined there had been a failure to conduct a risk assessment. The Massachusetts Attorney General determined that state laws had been violated in addition to HIPAA, and Comstar paid an additional $515,000 to settle the state case.
Comstar is not an outlier. Community Health Systems/CHSPSC, Anthem Inc., Premera Blue Cross, Aetna, Cottage Health System, University of Rochester Medical Center, and Medical Informatics Engineering have all settled with OCR and separately with state attorneys general to resolve potential HIPAA violations.
How State Attorneys General HIPAA Enforcement Works, and Why It Matters
State attorneys general do not enforce HIPAA in place of the Office for Civil Rights. They enforce it alongside OCR, on behalf of the residents of their own states. That changes the risk calculus in three ways.
First, the legal basis is broader than HIPAA alone. In many enforcement actions, the financial penalties resolve violations of federal HIPAA and/or state laws. There have been several cases where the HIPAA Rules were violated but the decision was made to bring actions under the equivalent provisions of state laws, such as state consumer protection and data security statutes. The HIPAA Journal's tables include cases where the HIPAA Rules were violated but action was taken for violations of state laws. That means a covered entity can face a state action even where the pleading is framed entirely in state-law terms.
Second, the technical expectations converge on the same controls. Whether the action is brought under the HIPAA Security Rule at 45 CFR Part 164, Subpart C (https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C) or under a state data security law, the underlying failures described in these cases are familiar: unencrypted devices, delayed breach notifications, unpatched known vulnerabilities, and, in the Comstar OCR action, a failure to conduct a risk assessment. NIST SP 800-66 Rev. 2 (https://csrc.nist.gov/pubs/sp/800/66/r2/final) provides practical guidance for regulated entities of all sizes on safeguarding electronic protected health information against reasonably anticipated threats, hazards, and impermissible uses and disclosures, and maps the Security Rule's standards to the NIST Cybersecurity Framework.
Third, geography multiplies exposure. A single breach affecting residents of many states can draw a multistate investigation, as the 49-state Blackbaud action and the New York, New Jersey, and Connecticut Enzo Biochem action show. For a business associate serving healthcare clients across state lines, the practical consequence is that a breach is not one negotiation with one regulator. It is potentially many, running in parallel with any OCR investigation of the same incident.
What the Evidence Does and Does Not Show
The enforcement record is clear in its direction but uneven in its year-to-year pattern. The HIPAA Journal tracker shows 11 settlements from 2010 to 2015, then 5 in 2017, 12 in 2018, 5 financially penalized cases across 2019 and 2020, 16 actions in 2023, 9 in 2024, and only one financial penalty in 2025. The sources do not explain why enforcement volume fluctuates, so any theory about staffing, priorities, or case pipelines would be speculation.
The sources also do not state the total number of state AG actions resolved through non-financial outcomes, such as corrective action plans without penalties, so the published settlement counts should be read as a floor rather than a complete census of state AG activity.
Several specific questions remain open. The sources do not say how state attorneys general select which breaches to pursue, how long their investigations typically take, or how state penalties are calculated relative to OCR penalties for the same incident. The Comstar case shows both enforcers acting on one breach, but the sources do not establish whether that coordination is typical.
Finally, the sources describe the violations alleged in each case, such as failures to patch a known vulnerability, unreported hacking incidents, and disclosure of patient information to law enforcement without a warrant, but they do not provide the underlying investigation files. Readers should treat the case summaries as the regulators' settled positions, not as complete technical post-mortems. What the record does establish, consistently, is that the same control failures appear on both the federal and state sides of HIPAA enforcement, and that state attorneys general are now a permanent and sometimes larger part of the enforcement picture.
Compliance and Risk Implications for Regulated Organizations
The rise of state attorneys general HIPAA enforcement changes the risk calculus for any organization that handles protected health information. Under the HITECH Act, state attorneys general can bring civil actions on behalf of state residents harmed by violations of the HIPAA Privacy and Security Rules, and they can obtain damages for those residents. That means a single breach can now draw two independent enforcement tracks: the HHS Office for Civil Rights on the federal side, and one or more state attorneys general on the state side. The Comstar case in 2026 illustrates the point plainly. The company paid $75,000 to OCR, which found a failure to conduct a risk assessment, and an additional $515,000 to settle the Massachusetts Attorney General's case, which was assisted by the Connecticut Attorney General.
The pattern in recent enforcement actions also shows that state attorneys general frequently act under state consumer protection, data security, and breach notification laws when the underlying conduct involves HIPAA Rule violations. In many cases the financial penalties resolve violations of both federal and state law, and in some cases the action is brought under the equivalent provisions of state law rather than HIPAA itself. For a compliance officer, this means your exposure is not limited to the federal rulebook. State statutes with their own penalties, and sometimes requirements that go beyond HIPAA, apply in parallel.
There is also a structural lesson in the enforcement data. Multistate actions, where several attorneys general pool resources to investigate potential violations of HIPAA and state laws, have produced some of the largest penalties, including the 49-state action against Blackbaud over its 5.5 million-record breach, which resulted in a $49.5 million penalty. When a breach touches residents of many states, expect many regulators at the table. And when state attorneys general impose penalties, they increasingly pair them with required cybersecurity investments, as seen in the New York actions against Albany ENT & Allergy Services and Refuah Health Center, where monetary penalties came with mandated spending on security improvements.
Finally, note what the underlying failures tend to be. The cases described involve unreported hacking incidents, failure to patch known vulnerabilities, ransomware attacks, failure to implement appropriate safeguards, and breach response failures. These are the same fundamentals the HIPAA Security Rule at 45 CFR Part 164 requires: a risk analysis under 45 CFR 164.308(a)(1)(ii)(A), plus 18 standards across administrative, physical, and technical safeguards. Organizations that cannot demonstrate a current risk analysis and documented safeguards are exposed on both federal and state fronts. NIST SP 800-66 Rev. 2 provides practical guidance for regulated entities of all sizes on safeguarding electronic protected health information and understanding the Security Rule, and it is a sensible alignment target for documentation (https://csrc.nist.gov/pubs/sp/800/66/r2/final).
What This Means for Regulated Industries
Healthcare Providers and Business Associates
Healthcare organizations are the direct audience for this enforcement trend. The 2024 actions show that covered entities of modest size, including a dental practice and community health centers, face real state-level penalties, not just large hospital systems. New York alone reached four settlements in 2024, and two of its actions required significant cybersecurity investments on top of fines. If you are a covered entity, assume that a breach will be reviewed by your state attorney general as well as OCR. If you are a business associate, note that attorneys general have pursued business associates directly, including vendors such as Blackbaud, Enzo Biochem, and XTIUM. Your contractual and technical safeguards matter to more regulators than you may assume. A structured program built around the Security Rule, documented through a current security risk assessment, is the baseline; our HIPAA compliance services are built for exactly this.
Defense Contractors
Defense contractors that handle protected health information, for example through an employee health clinic, a medical device subsidiary, or healthcare data in a joint venture, face a dual compliance environment. The HIPAA Security Rule applies to ePHI regardless of the industry, and CMMC Level 2 requires the 110 controls of NIST SP 800-171 Rev 2 for controlled unclassified information. The disciplines overlap: risk analysis, access control, audit logging, and incident response appear in both frameworks. A contractor that builds its HIPAA program on NIST SP 800-66 Rev. 2 alignment and its CMMC program on NIST SP 800-171 will find the two efforts reinforce each other rather than compete for budget. DFARS 252.204-7012 also requires reporting cyber incidents affecting covered defense information to DoD within 72 hours of discovery, so incident response procedures should be written to satisfy both timelines.
Legal Practices
Law firms are frequently business associates when they handle litigation, transactions, or disputes involving health information, and the enforcement record shows attorneys general will pursue business associates directly. The 2024 New York action against Perry Johnson & Associates, a company associated with a 2023 cybersecurity incident, and the 2026 action involving Boston Children's Health Physicians and its vendor XTIUM, both demonstrate that vendors in the data chain carry state-level exposure. Firms should confirm their own Security Rule safeguards, their breach notification procedures, and their vendor oversight, rather than assuming the healthcare client bears the compliance burden.
Financial Services
Financial services firms generally fall outside HIPAA unless they operate health-related lines, such as health savings account administration, benefits administration, or health-focused insurance products. Where they do touch ePHI, the same state attorney general exposure applies, and state data breach notification and consumer protection laws apply broadly across the sector regardless of HIPAA status. The practical takeaway is narrower for this industry: know whether any part of your data estate contains ePHI, because if it does, HIPAA and state health data enforcement follow it.
An Action Plan for This Month
- Confirm your risk analysis is current. The Comstar OCR penalty was grounded in a failure to conduct a risk assessment. If your risk analysis is older than a year or does not reflect your current environment, schedule an update now. Our HIPAA security risk assessment process produces the documented analysis regulators expect.
- Map your state exposure. Identify every state where you have patients, employees, or data, because each state attorney general with affected residents may participate in an action. Multistate actions pool resources and raise the stakes.
- Inventory your business associates. List every vendor that creates, receives, maintains, or transmits ePHI on your behalf, and confirm current business associate agreements are in place. The enforcement record shows vendors are named defendants.
- Verify patch management for known vulnerabilities. At least one 2024 state enforcement action cited a data breach after failure to patch a known vulnerability. Confirm you have evidence of timely patching.
- Test your breach notification procedures. The Breach Notification Rule at 45 CFR 164.404, 164.406, and 164.408 sets notification duties, and delayed notification was the basis of the first state attorney general HIPAA action against Health Net in 2010. Walk through who calls whom, in what order, within what timeframe.
- Review your encryption posture. The original Health Net case involved the loss of an unencrypted hard drive containing the ePHI of 1.5 million individuals. Confirm ePHI is encrypted at rest and in transit, and document it.
- Align documentation to NIST SP 800-66 Rev. 2. There is no HHS-issued HIPAA certification, so documented alignment to NIST SP 800-66 Rev. 2 and the OCR audit protocol is the strongest evidence of good faith you can produce.
- Check your incident response plan against dual enforcement. Your plan should contemplate parallel OCR and state attorney general investigations, including preservation of evidence and consistent messaging to both.
- Train staff on impermissible disclosures. Recent actions include unlawful disclosure of patient information to law enforcement without a warrant and impermissible disclosure of PHI through website tracking tools. Targeted training closes the gaps that technical controls cannot.
- Get an outside read on your program. A short, structured review by practitioners who work across HIPAA, CMMC, and state data security laws will find the gaps before an attorney general does. Start with our compliance services hub.
How Petronella Technology Group, Inc. Helps
Petronella Technology Group, Inc. has delivered cybersecurity and compliance services since 2002, remote-first across all 50 states, from our office at 5540 Centerview Dr Suite 200, Raleigh NC 27606. For healthcare organizations and business associates facing a dual-enforcement environment, the relevant capabilities are concrete.
Our HIPAA compliance services build the documented program the Security Rule requires: risk analysis under 45 CFR 164.308(a)(1)(ii)(A), the 18 standards across administrative, physical, and technical safeguards, policies, and evidence aligned to NIST SP 800-66 Rev. 2 and the OCR audit protocol. Our AI-enhanced HIPAA Security Rule compliance offering and HIPAA compliance software support ongoing management rather than a one-time checkbox exercise.
On the technical side, our managed security and MDR service provides 24/7 threat monitoring, AI-powered analytics, and human-led investigation, with reporting designed to provide the evidence auditors need for HIPAA, CMMC, PCI DSS, SOC 2, and NIST 800-171 verification. Our AI-augmented hybrid SOC runs on a private AI cluster, which serves healthcare clients that cannot send PHI to a public-cloud SOC, and every action is logged for HIPAA audit. A Digital Forensics Examiner is on staff for incident response.
For organizations that hold both ePHI and controlled unclassified information, our vCISO practice provides a named security officer of record for HIPAA under 45 CFR 164.308(a)(2), with formal designation documentation, a written current-state assessment within 30 days, and a 90 to 180 day remediation roadmap written for the executive reader. Our healthcare cybersecurity practice ties these threads together for providers and their vendors. If you want your staff prepared before an incident, our CMMC, HIPAA and cybersecurity training covers the human layer.
Related reading
- HIPAA Compliance Services
- HIPAA Violation Penalties 2026: Fines and Enforcement
- HIPAA Compliance Consulting Guide
- Fairchild Medical Center & Boone Health Settle Pixel Lawsuits
- 5 HIPAA Violations That Get Healthcare Organizations Fined
Sources
- HIPAA Enforcement by State Attorneys General
- 45 CFR Part 164 - Subpart C - Security Standards for the Protection of Electronic Protecte
- SP 800-66 Rev. 2, Implementing the Health Insurance Portability and Accountability Act (HI
Frequently Asked Questions
Can state attorneys general enforce HIPAA?
Yes. The HITECH Act gave state attorneys general the authority to bring civil actions on behalf of state residents harmed by violations of the HIPAA Privacy and Security Rules, and to obtain damages for those residents. Connecticut was the first to exercise this right in 2010 against Health Net, settling for $250,000.
How many HIPAA enforcement actions have state attorneys general brought recently?
Enforcement has been active in recent years. There were 16 enforcement actions in 2023, 9 enforcement actions in 2024 with $19,560,000 in total fines, one financial penalty in 2025, and an early 2026 action by the Massachusetts Attorney General against Comstar for $515,000.
Can I face both OCR and state attorney general penalties for the same breach?
Yes. State attorney general actions are separate from Office for Civil Rights actions, and OCR may investigate and impose its own penalties for the same incident. Comstar paid $75,000 to OCR and an additional $515,000 to settle the state case arising from the same breach.
Which states are most active in HIPAA enforcement?
New York has been the most active recently, with four settlements in 2024 and the only financial penalty in 2025, a $500,000 fine against Orthopedics NY. California followed with three enforcement actions in 2024, and multistate actions have included coalitions of up to 49 states.
Do state attorney general penalties only cover HIPAA violations?
No. In many cases the penalties resolve violations of both HIPAA and state laws, and in several cases attorneys general brought actions under equivalent provisions of state consumer protection, data security, or breach notification laws even where HIPAA Rules were violated. This means state statutes with their own penalties apply alongside the federal rules.
What should a healthcare organization do first to reduce this exposure?
Start with a current, documented security risk analysis, because the failure to conduct one was the basis of the OCR penalty in the Comstar matter and risk analysis is a core Security Rule requirement. Then confirm breach notification procedures, encryption, patching, and business associate agreements. If you need help scoping the work, call Penny, our AI assistant, at 919-348-4912, or reach Petronella Technology Group, Inc. through our contact form. The first consultation is a free 30-minute scoping call.
Free, practical, and specific to regulated environments. We will email it to you.
No spam. Unsubscribe anytime.
