NY AG James and CT AG Tong Secure $2.7 Million from Boston Children’s Health Physicians and XTIUM for 2024 Data Breach
The New York and Connecticut attorneys general reached a $2.7 million settlement with Boston Children's Health Physicians and its IT vendor XTIUM over a 2024 data breach. The agreement also requires both organizations to implement a corrective action plan to strengthen their data security practices.
Why this matters: This settlement matters because it holds the IT company liable alongside the healthcare provider. That is not always how these cases go. Usually the organization that got breached pays up and the vendor walks away. Here, the company responsible for managing the infrastructure shares the penalty. If you entrust your child's medical records to a pediatric practice, you probably assume someone is watching the technical side carefully. This case says that when the vendor fails, they can be on the hook too.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.