News for hackers. Stuff that matters.

A comment on Telehealth startup Cerebral shared millions of patients’ data with advertisers. Parent comment

Re:Telehealth startup Cerebral shared millions of patients’ ... by wins32767 on Friday March 10, 2023 @11:01AM (#35096096)
That's going to be tens of millions of dollars of fines. HIPAA is not anything to mess around with. Data breaches like that are an existential threat to a medtech.
[ Parent | on HN ]
Re:Telehealth startup Cerebral shared millions of patients’ ... by junon on Friday March 10, 2023 @11:10AM (#35096254)
If memory serves the fines stop after 1.5 million. Please someone correct me if I'm misremembering.
[ Parent | on HN ]
Re:Telehealth startup Cerebral shared millions of patients’ ... by warent on Friday March 10, 2023 @11:31AM (#35096619)
It looks like the maximum penalty (if corrected within 30 days) is about $450,000 as of 2022.

However, there is apparently an addendum to the law that the State Attorney General is authorized to impose civil penalties in addition to this.

As we see, Anthem settled for $115,000,000 for a similar breach.

So, yeah, unless Cerebral gets a very lenient AG, they're done.

https://www.hipaajournal.com/court-approves-anthem-115-milli...

https://www.hipaajournal.com/what-is-the-maximum-penalty-for...

[ Parent | on HN ]
Re:Telehealth startup Cerebral shared millions of patients’ ... by time0ut on Friday March 10, 2023 @04:47PM (#35101566)
They bumped it to 1.9 for inflation. There are also criminal jail time penalties though. It depends on intent. Unlikely it would happen though even if it is deserved.
[ Parent | on HN ]