The Vermont Office of the Attorney General reported a data breach involving OrthopedicsNY, LLP on December 17, 2024. The breach, discovered on December 28, 2023, involved unauthorized access that may have exposed individuals' names and Social Security Numbers. The specific number of individuals affected is unknown.

New York AG Secures $500K Settlement with OrthoNY Over 2023 Data Breach New York Attorney General Letitia James has reached a $500,000 settlement with OrthopedicsNY, LLP (OrthoNY), a New York-based orthopedics practice, following a 2023 data breach that exposed the personal information of over 650,000 patients and employees. The breach compromised sensitive data, including Social Security numbers, driver’s license numbers, and passport details for approximately 110,000 individuals. The settlement, announced by the New York Office of the Attorney General (OAG), stems from an investigation that found OrthoNY failed to adequately protect patient and employee data, violating state laws. In addition to the financial penalty, OrthoNY must provide affected individuals with one year of free credit monitoring and implement stricter security measures, including: - A comprehensive information security program to safeguard patient data. - Policies to limit access to sensitive information. - Multi-factor authentication for remote network access. - Encryption of collected, stored, and transmitted data. - Network monitoring systems to detect anomalous activity. - Annual risk assessments to identify security vulnerabilities. Attorney General James emphasized the responsibility of healthcare providers to secure patient data, stating that OrthoNY’s failure to do so violated the trust of those it serves. The settlement reflects the OAG’s increased enforcement of data security laws, following recent actions against other organizations, including ed tech providers, auto insurers, and a home security company. The case underscores the growing role of state attorneys general in enforcing data protection standards alongside federal regulations like HIPAA.