Who was sanctioned, and for what?

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The neurotechnology company from Dallas, described by the Bureau of Industry and Security (BIS, the export control agency of the US Department of Commerce) as small, delivered neural data acquisition systems (“OmniPlex”) and accessories worth around 179,000 USD on eight occasions in 2022/23 via its Asian distributor to the Chinese Academy of Military Medical Sciences, which has been on the Entity List (the US export control list of restricted parties) since December 2021. The penalty of 1.7 million USD is suspended for five years and then waived, provided that Plexon submits an external audit of its export compliance programme on time and commits no further violations; a five-year denial of export privileges is likewise suspended, and Plexon must also provide export control training.

Authority / court

U.S. Department of Commerce, Bureau of Industry and Security (BIS)

Area of law

Sanctions and export control · Export control and dual-use goods

Legal basis

Export Administration Regulations, 15 C.F.R. § 764.2(a), § 744.11

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Penalty and denial of export privileges fully suspended for five years, conditional on an external export control audit.

Published

14 Aug 2026

Original amount 1,700,000 USD, converted at the ECB reference rate of 14 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The Houston laboratory allegedly paid kickbacks and billed Medicare and Medicaid for medically unnecessary genetic tests. The settlements with the laboratory and other parties add up to 36.4 million USD (combined total); the laboratory is subject to a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Original amount 36,400,000 USD, converted at the ECB reference rate of 30 Jul 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Florida laboratory provided referring physicians with consulting services below market value and paid independent consultants referral-based remuneration for recruiting physicians. Following a self-disclosure, NeoGenomics paid 9,813,260 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Self-disclosure of the remuneration arrangements.

Original amount 9,813,260 USD, converted at the ECB reference rate of 20 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

On application by a competitor, the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) established that the laboratory had offered packages of medical laboratory tests free of charge nationwide over extended periods (only against a fee of 2 leva for taking blood) – conduct shown by no other market participant outside joint campaigns. It found an infringement of the general clause of unfair competition law (Art. 29 ZZK – Bulgarian Protection of Competition Act) and imposed 0.3% of 2024 turnover, i.e. 52,096.55 EUR. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 29 ZZK (Generalklausel unlauterer Wettbewerb)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Published

2 Jul 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In the teaching hospital's virology laboratory, the lid of a centrifuge fell on an employee who had to hold it open by hand because of a defective gas spring; she was seriously injured. Maintenance reports from 2023 and 2024 had already called for the spring to be replaced. Fine of CA$65,000 plus victim fine surcharge.

Authority / court

Provincial Offences Court Hamilton (Ermittlung: Ontario Ministry of Labour, Immigration, Training and Skills Development)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 25(1)(b) Occupational Health and Safety Act (Ontario)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Guilty plea; repair two days after the accident.

Published

21 Jul 2026

Original amount 65,000 CAD, converted at the ECB reference rate of 18 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The Arkansas pathology laboratory and its management company allegedly granted unlawful kickbacks and ordered medically unnecessary tests. The settlement of 30 million USD is a joint payment by all settling parties; the laboratory entered into a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Original amount 30,000,000 USD, converted at the ECB reference rate of 17 Jun 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Monash IVF collected sensitive information about visitors to its fertility treatment website through third-party tracking pixels. The Privacy Commissioner held that following the visitors of health-related websites and afterwards showing them targeted adverts on social networks amounts to collecting sensitive data, which requires consent, and found breaches of APP 3.3, 5.1, 5.2 and 7.1. Monash IVF must not continue or repeat the conduct and must implement specified remedial steps; a parallel determination against the telehealth provider Medmate Australia was made on the same day.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Cookies and tracking

Legal basis

Privacy Act 1988 (Cth), APP 3.3, 5.1, 5.2, 7.1

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

24 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

In November 2018 attackers encrypted patient data in the laboratory information system of Midlands Regional Hospital Tullamore. The DPC found that the HSE had infringed Art. 5(1)(f), 28, 30, 32(1) and 34 GDPR (including insufficient security, deficient processor contracts and record of processing, and incomplete notification of affected persons), issued a reprimand, imposed €300,000 for the security failings (Art. 5(1)(f) and 32(1)) and ordered it to introduce specified policies and procedures for secure processing.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 28, 30, 32(1), 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 2 Oct 2026 · Direct link

The non-profit hospital group Ascension wanted to acquire AmSurg for 3.9 billion USD. Owing to overlaps in outpatient surgery in five regions, the Federal Trade Commission (FTC) requires the sale of seven AmSurg centres to SC Affiliates and a gastroenterology practice, as well as transitional support.

Authority / court

Federal Trade Commission (FTC)

Area of law

Competition law · Merger control

Legal basis

Section 7 Clayton Act; Section 5 FTC Act (Consent Order)

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The security shortcomings were remedied after the inspections.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Californian provider of mobile PET scans allegedly paid referring cardiologists excessive fees for supervising the examinations in order to secure referrals. The settlement of 8,334,350.71 USD plus revenue-based payments is based on ability to pay; in addition, there is a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice / U.S. Attorney's Office, Central District of California

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 8,334,350.71 USD, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following an investigation by SafeWork NSW, the District Court of NSW fined LiveBetter Services Limited 675,000 AUD for a breach of ss 32/19(2) of the Work Health and Safety Act 2011. In February 2022, a participant in the National Disability Insurance Scheme (NDIS) was placed in a bath with excessively hot water, suffered serious burns and died from her injuries.

Authority / court

SafeWork NSW

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Work Health and Safety Act 2011 (NSW) ss 32/19(2)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Original amount 675,000 AUD, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Four laboratories and their association coordinated negotiations on prices with health insurers, coordinated in tenders, exchanged sensitive information and allocated customers. At first instance, the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 14,551,800 EUR and three-year procurement bans; Unilabs received a substantially reduced fine as leniency applicant and under a settlement.

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Kartellverbot)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Unilabs: leniency reduction (50%) and settlement (a further 30%).

Published

12 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data processors

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In parallel with the US declination, the PNF concluded a CJIP with the US subsidiary of the French medical technology manufacturer for 1,765,493 EUR (after crediting the US disgorgement) and a three-year AFA compliance programme. The case arose from Balt SAS's voluntary self-disclosure of 22 May 2023 concerning conduct at the acquired company Blockade Medical.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); aktive und passive Bestechung von Amtsträgern

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

250 to 999

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure to the PNF and the DOJ; coordinated resolution with crediting.

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

19 Mar 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Through sham consultancy agreements, fictitious invoices and purported bonus payments, around 602,000 USD in bribes flowed from 2017 to 2023 via a Belgian consultant to a physician in a senior position at a French public hospital, so that the hospital would purchase embolisation coils from Balt. The DOJ declined to prosecute on account of voluntary self-disclosure, cooperation and remediation (declination of 17 March 2026); Balt is disgorging 1,214,797 USD in profits.

Authority / court

U.S. Department of Justice (Criminal Division, Fraud Section)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

FCPA; Corporate Enforcement and Voluntary Self-Disclosure Policy (Declination)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure (including to the French national financial prosecutor's office, PNF), full cooperation, timely remediation, disciplinary measures, parallel resolution in France.

Liability of senior managers

Measures against individuals are not reported here.

Published

19 Mar 2026

Original amount 1,214,797 USD, converted at the ECB reference rate of 17 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Between January and June 2023, the Sarasota laboratory paid independent marketers to steer laboratory samples from Medicare beneficiaries to it. It self-disclosed the conduct, cooperated extensively and paid 980,000 USD.

Authority / court

U.S. Attorney's Office, Middle District of Florida

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Voluntary self-disclosure, detailed disclosure and cooperation.

Original amount 980,000 USD, converted at the ECB reference rate of 5 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The clinic’s managing director himself reported that a former employee had copied contact details and patient records of all patients and poached them for a new clinic. In the subsequent investigation, the clinic did not fully answer the requests of the Romanian data protection authority (ANSPDCP) despite a reprimand and an order; the authority therefore imposed 10,190 lei (2,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in February 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Feb 2026

Original amount 10,190 RON, converted at the ECB reference rate of 20 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following the tragedy at the Lapu-Lapu Day festival in 2025, 36 employees of three health authorities accessed patient data of 16 admitted persons without authorisation in 71 instances. Those affected were not informed without undue delay; the Information and Privacy Commissioner for British Columbia (OIPC BC) made nine recommendations, including automated access monitoring and deterrent disciplinary measures.

Authority / court

Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Area of law

Data protection · Data breaches and data security

Legal basis

Freedom of Information and Protection of Privacy Act (FIPPA) BC, s. 25.1

Action

Other

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Appropriate safeguards were in place; the authorities responded quickly and accepted all recommendations.

Published

18 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

The two companies colluded in tenders of the General Health Insurance Company for the supply of medicines (2017–2020). For the first time, a cartel was uncovered on the basis of information from a whistleblower; the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 7,595,200 EUR and a one-year procurement ban on PHOENIX and 201,800 EUR and a three-year procurement ban on TRANSMEDIC (first instance).

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Submissionsabsprache)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

PHOENIX: settlement with a 30% fine reduction and a shortened procurement ban.

Published

24 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

The hospital (until 2015 Hudson Valley Hospital Center) allegedly paid an oncology practice in Westchester millions of dollars to induce it to refer patients to the hospital; the hospital billed the services to Medicare and Medicaid. The U.S. Attorney’s Office filed a complaint and at the same time concluded a settlement of 6.8 million USD.

Authority / court

U.S. Attorney's Office, Southern District of New York

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 6,800,000 USD, converted at the ECB reference rate of 22 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

According to the FTC, the telemedicine company advertised GLP-1 weight-loss programmes with monthly prices that did not include medication, laboratory costs and medical consultations, concealed the minimum term and cancellation fees, published fake testimonials from employees and relatives, and induced customers to delete negative reviews by offering vouchers or refunds. Under the final settlement order, the company is paying 150,000 USD jointly with other liable parties (joint payment), which is earmarked for refunds.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Section 5 FTC Act; Restore Online Shoppers' Confidence Act (ROSCA)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Published

3 Dec 2025

Original amount 150,000 USD, converted at the ECB reference rate of 3 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

A hospital of the group had removed from its archive earlier MRI scans that a patient had brought in for comparison once an internal collection period had expired, so that they were no longer available. The AEPD imposed 100,000 EUR each for processing health data without a legal basis (Art. 9 and Art. 6) and 1,000,000 EUR for lack of data protection by design in the procedure (Art. 25), 1,200,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6, 9, 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Mar 2026

Checked against the official source on 28 Sep 2026 · Direct link

An assessment following several security compromises found that the laboratory company had notified neither the Information Regulator nor the affected data subjects. After an enforcement notice that it failed to comply with, it received an infringement notice with an administrative fine of ZAR 100,000, which has since been paid.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Data breaches and data security

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA), s. 22

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

13 Nov 2025

Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Doctolib tied doctors with exclusivity clauses, bundled telemedicine with the appointment booking subscription and in 2018 acquired its main competitor in order to eliminate it (decision 25-D-06). Fines: 4.615 million EUR for exclusivity and tying, 50,000 EUR for the acquisition.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV, Art. L.420-2 Code de commerce

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Culpability

intentional

Published

6 Nov 2025

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Despite access requests, two patients did not receive copies of their scan files at the end of treatment; the practice responded only sluggishly to enquiries and did not attend an appointment with the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered disclosure under Art. 15(3) GDPR or a reasoned refusal and threatened a penalty payment of 2,000 EUR.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. c, Art. 12 Abs. 4, Art. 15 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

On the application of the Australian Information Commissioner, the Federal Court of Australia imposed the first civil penalties under the Privacy Act 1988: Australian Clinical Labs (ACL) had failed to adequately protect the personal information held on the IT systems of its Medlab Pathology business; in a cyberattack in February 2022, data of more than 223,000 people was taken from those systems. The penalty of 5.8 million AUD in total comprises 4.2 million AUD for the inadequate security measures (APP 11.1), 800,000 AUD because ACL did not assess reasonably and promptly whether a notifiable data breach had occurred, and 800,000 AUD for the late notification to the Commissioner. ACL admitted the contraventions; liability and the penalty were allegedly based on joint submissions by the parties.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act 1988 (Cth) s 13G(a) i. V. m. APP 11.1; s 26WH(2); s 26WK(2)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

Cooperation with the investigation, an ongoing programme to uplift cyber security, apologies and admission of liability.

Liability of senior managers

The court found that the most senior management was involved in the decisions on integrating the Medlab systems and on assessing the attack.

Published

9 Oct 2025

Original amount 5,800,000 AUD, converted at the ECB reference rate of 8 Oct 2025.

Checked against the official source on 3 Oct 2026 · Direct link

For almost six years, the chair of the management board of the medical company was also its data protection officer; this came to light after a report that a patient had been handed documents relating to another person. Poland’s data protection authority (UODO) found a conflict of interest and imposed 11,365 PLN.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 6 DSGVO (DKN.5131.7.2025)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

An independent external data protection officer was appointed in July 2024.

Published

29 Sep 2025

Original amount 11,365 PLN, converted at the ECB reference rate of 12 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

A practice for aesthetic treatments advertised hyaluronic acid filler injections for the nose and chin on its website and on Instagram using before-and-after images. In an action brought by a consumer advice centre (Verbraucherzentrale), the BGH upheld the injunction issued by the Higher Regional Court of Hamm (OLG Hamm): such procedures are deemed to be surgical cosmetic procedures, for which this kind of advertising is prohibited.

Authority / court

Bundesgerichtshof (I. Zivilsenat), Az. I ZR 170/24

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 11 Abs. 1 Satz 3 Nr. 1, § 1 Abs. 1 Nr. 2 Buchst. c HWG; UKlaG

Action

Order

Status of proceedings

final

Sector

Healthcare

Published

31 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

The Minnesota provider of outpatient addiction treatment pays USD 18,500,000 to resolve False Claims Act allegations and entered into a five-year Corporate Integrity Agreement with HHS-OIG. According to the US Attorney's Office, from January 2019 to February 2025 NUWAY compensated Medicaid patients for attending intensive outpatient treatment and also billed services in which the same period of time was counted twice. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Attorney's Office, District of Minnesota (U.S. Department of Justice)

Area of law

Bribery and corruption · Gifts, hospitality and benefits

Legal basis

False Claims Act; Anti-Kickback Statute

Action

Other

Status of proceedings

final

Sector

Healthcare

Published

26 Jun 2025

Original amount 18,500,000 USD, converted at the ECB reference rate of 26 Jun 2025.

Checked against the official source on 3 Oct 2026 · Direct link

From April to September 2023, attackers used reused credentials to access data on 155,592 people in the United Kingdom, including ancestry, family trees and health information. There was no MFA, no secure password rules and no effective monitoring; despite anomalies in July 2023, the full investigation only began in October. Joint investigation by the UK Information Commissioner's Office (ICO) with the Privacy Commissioner of Canada.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Employees

250 to 999

Culpability

negligent

Published

17 Jun 2025

Original amount 2,310,000 GBP, converted at the ECB reference rate of 5 Jun 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2018–2022, the online pharmacy transmitted purchase data, including data on prescription medicines, to the tracking providers via Google and Meta tracking. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.1 million EUR and a reprimand; on 1 June 2026 the Helsingin hallinto-oikeus (Helsinki Administrative Court) upheld the infringement but annulled the fine because it was unclear whether a fine may be imposed on the university pharmacy at all (not final).

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio; Helsingin hallinto-oikeus

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 9, Art. 25, Art. 32

Action

Fine

Status of proceedings

overturned

Sector

Healthcare

Published

4 Jun 2025

Amount in EUR; no ECB reference rate is available for this currency.

Checked against the official source on 25 Sep 2026 · Direct link

The CADE Tribunal convicted the federal council of physiotherapists and occupational therapists because, through resolutions, rulings and annually updated reference tables, it had set binding minimum prices for the services of members of the profession and thereby encouraged uniform market conduct. In addition to a fine of 3,103,583.65 BRL, COFFITO must refrain from binding price tables, remove all references to them from its websites (penalty of 5,000.00 BRL per day) and publish the decision on its website and social media; proceedings against the regional council for the 15th region are suspended owing to a settlement. The amount and the facts have not been confirmed against the primary source.

Authority / court

Conselho Administrativo de Defesa Econômica (CADE), Tribunal Administrativo

Area of law

Competition law · Cartels and collusion

Legal basis

Lei nº 12.529/2011; Art. 38 und 39 (Nebenanordnungen)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

10 Apr 2025

Original amount 3,103,583.65 BRL, converted at the ECB reference rate of 9 Apr 2025.

Checked against the official source on 3 Oct 2026 · Direct link

Despite being asked to do so, a healthcare provider (name redacted) did not correct a patient’s address, so that health reports were sent to third parties, and used address data from the electoral register without a legal basis. The Information and Data Protection Commissioner (IDPC) issued a reprimand, ordered rectification, erasure of the register data and the designation of a data protection officer, and imposed fines of 12,500, 5,000 and 2,500 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und d, Art. 6 Abs. 1, Art. 14, 16, 37 Abs. 1 lit. c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

The Markkinaoikeus (Market Court, Finland) imposed a penalty payment of 1,500,000 EUR on the care services provider Attendo Suomi Oy for obstructing an unannounced inspection by the competition authority in January 2023: after the inspection had begun, a manager deleted chat histories and the call log on a mobile phone also used for work. It was the first penalty for such a procedural infringement in Finland; the authority had sought 4,373,760 EUR, but the court gave considerably more weight to Attendo's own measures, including the swift restoration of the deleted chats.

Authority / court

Markkinaoikeus (Marktgericht) auf Antrag des Kilpailu- ja kuluttajavirasto (KKV)

Area of law

Competition law

Legal basis

Kilpailulaki (948/2011) 37 a § 1 mom. 1 kohta i. V. m. 35 § und 37 §

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Training and instructions for staff on conduct during inspections already before the incident; swift restoration and handover of the deleted chats from a backup; no advantage gained and no earlier penalties for procedural infringements.

Published

31 Mar 2025

Checked against the official source on 28 Sep 2026 · Direct link

Following a tip-off from the Military Medical Academy (VMA), the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found that the centre presented its gynaecological practice as a VMA branch with signs reading ‘МЦ „ЛЮЛИН МЕД“ АГ – ВМА ФИЛИАЛ’ and corresponding online information. For misleading conduct (Art. 31 ZZK – Bulgarian Protection of Competition Act) it imposed 0.4% of 2023 turnover, i.e. 9,236 leva. An appeal has been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 31 ZZK (Irreführung)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Original amount 9,236 BGN, converted at the ECB reference rate of 6 Feb 2025.

Checked against the official source on 25 Sep 2026 · Direct link