Comstar LLC Settles with State and Federal Regulators Over 2022 Ransomware Breach In a significant enforcement action, ambulance billing firm Comstar LLC has reached settlement agreements with the Attorneys General of Massachusetts and Connecticut, as well as the U.S. Department of Health and Human Services (HHS), over a 2022 ransomware attack that exposed the protected health information (PHI) of 585,621 individuals. The incident, disclosed on March 25, 2022, involved unauthorized access, encryption, and exfiltration of sensitive data, including names, Social Security numbers, driver’s license details, financial account information, and medical records. ### Key Findings and Violations HHS’s investigation determined that Comstar failed to conduct a thorough risk assessment of its electronic PHI, violating HIPAA Security Rule requirements. The breach impacted over 320,000 Massachusetts residents and 22,000 Connecticut residents, prompting state-level enforcement under the HITECH Act, which grants state regulators authority to enforce HIPAA. ### Settlement Terms and Financial Penalties - HHS Settlement (May 30, 2025): Comstar agreed to a corrective action plan, including: - Developing an inventory of PHI assets - Conducting a risk analysis and management plan - Revising HIPAA compliance policies - State Settlements (January 28, 2026): - Massachusetts: $415,000 fine + enhanced security requirements - Connecticut: $100,000 fine + similar compliance measures - Combined state penalties ($515,000) exceeded HHS’s settlement by nearly seven times, highlighting the growing role of state regulators in HIPAA enforcement. ### Cybersecurity and Privacy Mandates The settlements imposed strict cybersecurity and data governance reforms, including: - Encryption of PHI at rest and in transit - Annual risk assessments and penetration testing - Multi-factor authentication (MFA) for all user and admin accounts - Zero-trust architecture and a Written Information Security Program (WISP) - Appointment of a Chief Information Security Officer (CISO) to oversee compliance - Enhanced monitoring (SIEM, EDR, DLP, email filtering) - Data minimization and archiving policies, requiring Comstar to move older records to offline storage (e.g., archiving patient data after two years unless legally required otherwise) - Expanded employee training on privacy and security, including specialized instruction for IT staff ### Regulatory Trends and Implications The settlements reflect increased scrutiny from both federal and state regulators, with state enforcers imposing stricter penalties and more prescriptive security measures than HHS. The focus on data minimization, archiving, and zero-trust security signals a shift toward more nuanced information governance, where regulators expect organizations to limit data retention and secure older records to reduce breach risks. Comstar’s case underscores the dual enforcement risk for HIPAA-covered entities, as state regulators continue to coordinate with federal agencies while imposing additional financial and operational burdens. The settlements serve as a benchmark for compliance, particularly in healthcare-adjacent sectors, where PHI protection remains a top regulatory priority.