Maybe that's new, when I was a HIPAA architect for a health related company, I rarely saw anyone being sued or even investigated (mid 2000s). Given how many violations I saw there (and complained about) nothing ever changed because they felt no one would do anything to them.

It has changed a lot since then. 2015 was a huge overhaul of HIPAA and its enforcement.

Prior to that, it was just a polite suggestion.

+1

I work in publicly funded mental health and our responses to possible/actual HIPAA breaches are monitored very closely by our funders. So even if an event occurs that is not deemed to be an actual breach, if our response/investigation/corrective action is found to be unsatisfactory, our county/state/fed contracts, foundation grants, and Joint Commission Accreditation could be altered/canceled.

Really? That's surprising to me. I worked a hospital job for several years, and had heard of employees making minor infractions who were fired and sued by both the hospital as well as the patient(s). Though those were individuals, things could be different if you're a corporation [rolls eyes pessimistically].

9 times out of 10 those types of infractions are intentional, stuff like this: https://www.reliasmedia.com/articles/11576-13-hospital-worke...

>> even a minor infringement is taken very seriously. The lawsuits are gonna be something else.

Would be great to have a retrospective on this a year from now. I realize it isnt HIPPA, but from what I see from Credit Agency breaches, regulations are often just suggestions and there are no real consequences. Would be happy to see otherwise.

If this is anything like GoodRx, they're not viewed as a covered entity.

That's actually a common misconception, that HIPAA infringements mean people are going to jail for a long time or something.

While infringements are taken seriously, and intentional infringement (e.g. looking up the records of a famous celebrity being treated in your hospital without reason to) results in hefty penalities, 99% sure this was a case of them using Google Analytics/Tag Manager and accidentally tagging stuff with protected PII fields. Yes, definitely a serious issue, but on my scale of "breaches I would be concerned about", this one would actually be relatively low.