If it is a HIPPA violation the fines are deliberately per instance - eg 12 million * (the fine), and I can’t recall whether hippa considers each piece of data a separate violation.

But I think to be a HIPPA violation it would need to have information about what tests are involved - eg just a monetary debt and knowing it came from a lab might be argued as not being a violation?

That said until there are mandatory per-person-per-data-leaked fines, coupled with liability for misuse of that data, companies are just going to continue leaking because they “compensate” people by giving them “free” credit monitoring.

That last bit is great because it only resolves financial service harm, and offloads actually preventing fraud to the victims of these companies.