Who was sanctioned, and for what?

The medical technology manufacturer misled investors about regulatory risks of the Alaris infusion pump, which had more than 25 software defects, and did not record the remediation costs, as a result of which operating income in the fourth quarter of 2019 was overstated by 82 %. BD is paying 175 million USD and must appoint an independent compliance consultant.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Antifraud-, Reporting-, Buchführungs-, interne Kontroll- und Disclosure-Controls-Vorschriften der US-Wertpapiergesetze

Action

Fine

Status of proceedings

final

Sector

Healthcare

Original amount 175,000,000 USD, converted at the ECB reference rate of 16 Dec 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Houston laboratory, its former CEO Michael Stewart and the businessman Harold Shatz allegedly paid kickbacks and billed Medicare and Medicaid for medically unnecessary genetic tests. The three settlements add up to 36.4 million USD; the laboratory is subject to a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Former CEO pays under a separate settlement.

Original amount 36,400,000 USD, converted at the ECB reference rate of 30 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Florida laboratory provided referring physicians with consulting services below market value and paid independent consultants referral-based remuneration for recruiting physicians. Following a self-disclosure, NeoGenomics paid 9,813,260 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Self-disclosure of the remuneration arrangements.

Original amount 9,813,260 USD, converted at the ECB reference rate of 20 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

On application by its competitor Ramus, the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) established that the laboratory had offered packages of medical laboratory tests free of charge nationwide over extended periods (only against a fee of 2 leva for taking blood) – conduct shown by no other market participant outside joint campaigns. It found an infringement of the general clause of unfair competition law (Art. 29 ZZK – Bulgarian Protection of Competition Act) and imposed 0.3% of 2024 turnover, i.e. 52,096.55 EUR. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 29 ZZK (Generalklausel unlauterer Wettbewerb)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Published

2 Jul 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In the teaching hospital's virology laboratory, the lid of a centrifuge fell on an employee who had to hold it open by hand because of a defective gas spring; she was seriously injured. Maintenance reports from 2023 and 2024 had already called for the spring to be replaced. Fine of CA$65,000 plus victim fine surcharge.

Authority / court

Provincial Offences Court Hamilton (Ermittlung: Ontario Ministry of Labour, Immigration, Training and Skills Development)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 25(1)(b) Occupational Health and Safety Act (Ontario)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Guilty plea; repair two days after the accident.

Published

21 Jul 2026

Original amount 65,000 CAD, converted at the ECB reference rate of 18 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Arkansas pathology laboratory, its management company and the owners Kevin Hannah, Donell Burkett and Daniel Hunter Pledger allegedly granted unlawful kickbacks and ordered medically unnecessary tests. Together they paid 30 million USD; the laboratory entered into a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

The owners contribute personally as parties to the settlement.

Original amount 30,000,000 USD, converted at the ECB reference rate of 17 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The non-profit hospital group Ascension wanted to acquire AmSurg for 3.9 billion USD. Owing to overlaps in outpatient surgery in five regions, the Federal Trade Commission (FTC) requires the sale of seven AmSurg centres to SC Affiliates and a gastroenterology practice, as well as transitional support.

Authority / court

Federal Trade Commission (FTC)

Area of law

Competition law · Merger control

Legal basis

Section 7 Clayton Act; Section 5 FTC Act (Consent Order)

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Californian provider of mobile PET scans allegedly paid referring cardiologists excessive fees for supervising the examinations in order to secure referrals. The settlement of 8,334,350.71 USD plus revenue-based payments is based on ability to pay; in addition, there is a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice / U.S. Attorney's Office, Central District of California

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 8,334,350.71 USD, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Four laboratories and their association coordinated negotiations on prices with health insurers, coordinated in tenders, exchanged sensitive information and allocated customers. At first instance, the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 14,551,800 EUR and three-year procurement bans; Unilabs received a substantially reduced fine as leniency applicant and under a settlement.

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Kartellverbot)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Unilabs: leniency reduction (50%) and settlement (a further 30%).

Published

12 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data processors

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1 (NAIH-273-7/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In parallel with the US declination, the PNF concluded a CJIP with the US subsidiary of the French medical technology manufacturer for 1,765,493 EUR (after crediting the US disgorgement) and a three-year AFA compliance programme. The case arose from Balt SAS's voluntary self-disclosure of 22 May 2023 concerning offences committed by a former manager of the acquired company Blockade Medical.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); aktive und passive Bestechung von Amtsträgern

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

250 to 999

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure to the PNF and the DOJ; coordinated resolution with crediting.

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

19 Mar 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Through sham consultancy agreements, fictitious invoices and purported bonus payments, around 602,000 USD in bribes flowed from 2017 to 2023 via a Belgian consultant to a physician in a senior position at a French public hospital, so that the hospital would purchase embolisation coils from Balt. The DOJ declined to prosecute on account of voluntary self-disclosure, cooperation and remediation (declination of 17 March 2026); Balt is disgorging 1,214,797 USD in profits.

Authority / court

U.S. Department of Justice (Criminal Division, Fraud Section)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

FCPA; Corporate Enforcement and Voluntary Self-Disclosure Policy (Declination)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure (including to the French national financial prosecutor's office, PNF), full cooperation, timely remediation, disciplinary measures, parallel resolution in France.

Liability of senior managers

A former manager of the US subsidiary (David Ferrera) and a consultant (Marc Tilman) were charged with FCPA violations and money laundering.

Published

19 Mar 2026

Original amount 1,214,797 USD, converted at the ECB reference rate of 17 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between January and June 2023, the Sarasota laboratory paid independent marketers to steer laboratory samples from Medicare beneficiaries to it. It self-disclosed the conduct, cooperated extensively and paid 980,000 USD.

Authority / court

U.S. Attorney's Office, Middle District of Florida

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Voluntary self-disclosure, detailed disclosure and cooperation.

Original amount 980,000 USD, converted at the ECB reference rate of 5 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The clinic’s managing director himself reported that a former employee had copied contact details and patient records of all patients and poached them for a new clinic. In the subsequent investigation, the clinic did not fully answer the requests of the Romanian data protection authority (ANSPDCP) despite a reprimand and an order; the authority therefore imposed 10,190 lei (2,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in February 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Feb 2026

Original amount 10,190 RON, converted at the ECB reference rate of 20 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following the tragedy at the Lapu-Lapu Day festival in 2025, 36 employees of three health authorities accessed patient data of 16 admitted persons without authorisation in 71 instances. Those affected were not informed without undue delay; the Information and Privacy Commissioner for British Columbia (OIPC BC) made nine recommendations, including automated access monitoring and deterrent disciplinary measures.

Authority / court

Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Area of law

Data protection · Data breaches and data security

Legal basis

Freedom of Information and Protection of Privacy Act (FIPPA) BC, s. 25.1

Action

Other

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Appropriate safeguards were in place; the authorities responded quickly and accepted all recommendations.

Published

18 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The two companies colluded in tenders of the General Health Insurance Company for the supply of medicines (2017–2020). For the first time, a cartel was uncovered on the basis of information from a whistleblower; the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 7,595,200 EUR and a one-year procurement ban on PHOENIX and 201,800 EUR and a three-year procurement ban on TRANSMEDIC (first instance).

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Submissionsabsprache)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

PHOENIX: settlement with a 30% fine reduction and a shortened procurement ban.

Published

24 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The hospital (until 2015 Hudson Valley Hospital Center) allegedly paid an oncology practice in Westchester millions of dollars to induce it to refer patients to the hospital; the hospital billed the services to Medicare and Medicaid. The U.S. Attorney’s Office filed a complaint and at the same time concluded a settlement of 6.8 million USD.

Authority / court

U.S. Attorney's Office, Southern District of New York

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 6,800,000 USD, converted at the ECB reference rate of 22 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

According to the FTC, the telemedicine company advertised GLP-1 weight-loss programmes with monthly prices that did not include medication, laboratory costs and medical consultations, concealed the minimum term and cancellation fees, published fake testimonials from employees and relatives, and induced customers to delete negative reviews by offering vouchers or refunds. Under the final settlement order, the company and its management are paying 150,000 USD, which is earmarked for refunds.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Section 5 FTC Act; Restore Online Shoppers' Confidence Act (ROSCA)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Founder Robert Epstein and CEO Frank Leonardo III are named in the press release as parties involved.

Published

3 Dec 2025

Original amount 150,000 USD, converted at the ECB reference rate of 3 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Doctolib tied doctors with exclusivity clauses, bundled telemedicine with the appointment booking subscription and in 2018 acquired its main competitor MonDocteur in order to eliminate it (decision 25-D-06). Fines: 4.615 million EUR for exclusivity and tying, 50,000 EUR for the acquisition.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV, Art. L.420-2 Code de commerce

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Culpability

intentional

Published

6 Nov 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Despite access requests, two patients did not receive copies of their scan files at the end of treatment; the practice responded only sluggishly to enquiries and did not attend an appointment with the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered disclosure under Art. 15(3) GDPR or a reasoned refusal and threatened a penalty payment of 2,000 EUR.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. c, Art. 12 Abs. 4, Art. 15 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

For almost six years, the chair of the management board of the medical company was also its data protection officer; this came to light after a report that a patient had been handed documents relating to another person. Poland’s data protection authority (UODO) found a conflict of interest and imposed 11,365 PLN.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 6 DSGVO (DKN.5131.7.2025)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

An independent external data protection officer was appointed in July 2024.

Published

29 Sep 2025

Original amount 11,365 PLN, converted at the ECB reference rate of 12 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A practice for aesthetic treatments advertised hyaluronic acid filler injections for the nose and chin on its website and on Instagram using before-and-after images. In an action brought by a consumer advice centre (Verbraucherzentrale), the BGH upheld the injunction issued by the Higher Regional Court of Hamm (OLG Hamm): such procedures are deemed to be surgical cosmetic procedures, for which this kind of advertising is prohibited.

Authority / court

Bundesgerichtshof (I. Zivilsenat), Az. I ZR 170/24

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 11 Abs. 1 Satz 3 Nr. 1, § 1 Abs. 1 Nr. 2 Buchst. c HWG; UKlaG

Action

Order

Status of proceedings

final

Sector

Healthcare

Published

31 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

From April to September 2023, attackers used reused credentials to access data on 155,592 people in the United Kingdom, including ancestry, family trees and health information. There was no MFA, no secure password rules and no effective monitoring; despite anomalies in July 2023, the full investigation only began in October. Joint investigation by the UK Information Commissioner's Office (ICO) with the Privacy Commissioner of Canada.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Published

17 Jun 2025

Original amount 2,310,000 GBP, converted at the ECB reference rate of 5 Jun 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2018–2022, the online pharmacy transmitted purchase data, including data on prescription medicines, to the tracking providers via Google and Meta tracking. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.1 million EUR and a reprimand; on 1 June 2026 the Helsingin hallinto-oikeus (Helsinki Administrative Court) upheld the infringement but annulled the fine because it was unclear whether a fine may be imposed on the university pharmacy at all (not final).

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio; Helsingin hallinto-oikeus

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 9, Art. 25, Art. 32

Action

Fine

Status of proceedings

overturned

Sector

Healthcare

Published

4 Jun 2025

Amount in EUR; no ECB reference rate is available for this currency.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Despite being asked to do so, a healthcare provider (name redacted) did not correct a patient’s address, so that health reports were sent to third parties, and used address data from the electoral register without a legal basis. The Information and Data Protection Commissioner (IDPC) issued a reprimand, ordered rectification, erasure of the register data and the designation of a data protection officer, and imposed fines of 12,500, 5,000 and 2,500 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und d, Art. 6 Abs. 1, Art. 14, 16, 37 Abs. 1 lit. c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Following a tip-off from the Military Medical Academy (VMA), the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found that the centre presented its gynaecological practice as a VMA branch with signs reading ‘МЦ „ЛЮЛИН МЕД“ АГ – ВМА ФИЛИАЛ’ and corresponding online information. For misleading conduct (Art. 31 ZZK – Bulgarian Protection of Competition Act) it imposed 0.4% of 2023 turnover, i.e. 9,236 leva. An appeal has been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 31 ZZK (Irreführung)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Original amount 9,236 BGN, converted at the ECB reference rate of 6 Feb 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

A limited company operating a diagnostic laboratory (name pseudonymised), which during the pandemic carried out up to 45,000 PCR analyses a day with around 200 employees, had appointed its managing director as data protection officer at the same time. Because of the resulting conflict of interest, the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 5,000 EUR; the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection

Legal basis

Art. 37, Art. 38 Abs. 6 DSGVO

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

50 to 249

Liability of senior managers

The managing director was also appointed as data protection officer – an impermissible conflict of interest.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The cancer charity reported thefts of computers from its offices in Copenhagen and Aarhus as well as phishing attacks in 2019 and 2020; according to the Danish Data Protection Agency (Datatilsynet), at least 1,448 people were affected, some with health data. Although the organisation itself had considered multi-factor authentication necessary after an attack in 2018, this and encryption of the computers were lacking; Københavns Byret (Copenhagen City Court) issued a final judgment ordering it to pay 75,000 DKK (Datatilsynet’s recommendation and the prosecution’s request: 800,000 DKK).

Authority / court

Københavns Byret (auf Anzeige der Datatilsynet)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1; databeskyttelsesloven § 41

Action

Fine

Status of proceedings

final

Sector

Healthcare

Repeat case

yes

Original amount 75,000 DKK, converted at the ECB reference rate of 1 Oct 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) examined several complaints against the state hospital, including about the processing of patient and health data by a physician assistant and about an unanswered access request. Because the hospital did not provide the requested information, the authority imposed 2,000 EUR for breach of the duty to cooperate.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

In 2019, a specialist hospital in the Rijeka area (name not published) irretrievably lost patients’ radiological images because it did not make backup copies, and did not report the incident although management had been informed. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) imposed 190,000 EUR, including for a missing data processing agreement, call recordings without a legal basis and failure to involve the data protection officer.

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 6, 12, 13, 28 Abs. 3, 32 Abs. 1 lit. b, 33 Abs. 1, 38 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

13 Sep 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Between July 2019 and July 2023, Acadia Healthcare had employees waive potential awards for reports to authorities in 98 employment, separation, retention and settlement agreements; in 56 further separation and settlement agreements, they had to waive complaints to federal authorities. As part of a sweep against seven listed companies, Acadia paid 1,386,000 US dollars to the U.S. Securities and Exchange Commission (SEC); the contract templates were amended.

Authority / court

U.S. Securities and Exchange Commission

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Securities Exchange Act of 1934, Rule 21F-17(a)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Partial amendment of the templates even before contact by the SEC, information provided to those affected, and cooperation

Published

9 Sep 2024

Original amount 1,386,000 USD, converted at the ECB reference rate of 9 Sep 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The dialysis group allegedly paid kickbacks to promote referrals to its former pharmacy subsidiary DaVita Rx and granted benefits to nephrologists and vascular surgeons to induce them to send patients to DaVita dialysis centres. DaVita paid 34,487,390 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Employees

10,000 or more

Original amount 34,487,390 USD, converted at the ECB reference rate of 18 Jul 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Three home health agencies in Texas, Ohio and Indiana and their parent company allegedly granted kickbacks to assisted living facilities and physicians for Medicare referrals. They paid 4,496,330 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 4,496,330 USD, converted at the ECB reference rate of 1 Jul 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

At the care facility, employees worked up to 24 hours a day, seven days a week, were not allowed to leave the premises, had to work through breaks and received no overtime pay. The settlement of 658,948 USD comprises 608,948 USD for 34 employees (including overtime and break premiums) and 50,000 USD in civil penalties.

Authority / court

California Labor Commissioner's Office (Division of Labor Standards Enforcement)

Area of law

Health and safety and employment law · Working time

Legal basis

California Labor Code (Überstunden, Meal and Rest Periods, Mindestlohn)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 658,948 USD, converted at the ECB reference rate of 12 Jun 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

The Utah manufacturer of spinal implants and two executives – founder and president Brent Felix and former CFO Garth Felix – allegedly paid surgeons kickbacks to induce them to use Innovasis products. Together they paid 12 million USD; HHS-OIG placed the company under heightened scrutiny.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Founder/president and former CFO pay personally as parties to the settlement.

Original amount 12,000,000 USD, converted at the ECB reference rate of 29 May 2024.

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report

Since 2015, the chamber’s professional code had prohibited its members from offering services below list price, at a discount or free of charge and from advertising prices and promotions – including online. As the first decision under the new act and in the first settlement procedure, the Javna agencija Republike Slovenije za varstvo konkurence (Slovenian Competition Protection Agency, AVK) imposed 43,000 EUR.

Authority / court

Javna agencija Republike Slovenije za varstvo konkurence (AVK)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 5 ZPOmK-2, Art. 101 AEUV (3062-13/2019)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Settlement with acknowledgement of responsibility.

Published

22 Jan 2024

Checked against the official source on 25 Sep 2026 · Direct link

Report an error

Website What is wrong? Please include evidence if possible.

Anonymous: we store only your text — no contact details and no IP address.

Send report