Who was sanctioned, and for what?

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The neurotechnology company from Dallas, described by the Bureau of Industry and Security (BIS, the export control agency of the US Department of Commerce) as small, delivered neural data acquisition systems (“OmniPlex”) and accessories worth around 179,000 USD on eight occasions in 2022/23 via its Asian distributor to the Chinese Academy of Military Medical Sciences, which has been on the Entity List (the US export control list of restricted parties) since December 2021. The penalty of 1.7 million USD is suspended for five years and then waived, provided that Plexon submits an external audit of its export compliance programme on time and commits no further violations; a five-year denial of export privileges is likewise suspended, and Plexon must also provide export control training.

Authority / court

U.S. Department of Commerce, Bureau of Industry and Security (BIS)

Area of law

Sanctions and export control · Export control and dual-use goods

Legal basis

Export Administration Regulations, 15 C.F.R. § 764.2(a), § 744.11

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Penalty and denial of export privileges fully suspended for five years, conditional on an external export control audit.

Published

14 Aug 2026

Original amount 1,700,000 USD, converted at the ECB reference rate of 14 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The Houston laboratory allegedly paid kickbacks and billed Medicare and Medicaid for medically unnecessary genetic tests. The settlements with the laboratory and other parties add up to 36.4 million USD (combined total); the laboratory is subject to a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Original amount 36,400,000 USD, converted at the ECB reference rate of 30 Jul 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Florida laboratory provided referring physicians with consulting services below market value and paid independent consultants referral-based remuneration for recruiting physicians. Following a self-disclosure, NeoGenomics paid 9,813,260 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Self-disclosure of the remuneration arrangements.

Original amount 9,813,260 USD, converted at the ECB reference rate of 20 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

On application by a competitor, the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) established that the laboratory had offered packages of medical laboratory tests free of charge nationwide over extended periods (only against a fee of 2 leva for taking blood) – conduct shown by no other market participant outside joint campaigns. It found an infringement of the general clause of unfair competition law (Art. 29 ZZK – Bulgarian Protection of Competition Act) and imposed 0.3% of 2024 turnover, i.e. 52,096.55 EUR. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 29 ZZK (Generalklausel unlauterer Wettbewerb)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Published

2 Jul 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In the teaching hospital's virology laboratory, the lid of a centrifuge fell on an employee who had to hold it open by hand because of a defective gas spring; she was seriously injured. Maintenance reports from 2023 and 2024 had already called for the spring to be replaced. Fine of CA$65,000 plus victim fine surcharge.

Authority / court

Provincial Offences Court Hamilton (Ermittlung: Ontario Ministry of Labour, Immigration, Training and Skills Development)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 25(1)(b) Occupational Health and Safety Act (Ontario)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Guilty plea; repair two days after the accident.

Published

21 Jul 2026

Original amount 65,000 CAD, converted at the ECB reference rate of 18 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The Arkansas pathology laboratory and its management company allegedly granted unlawful kickbacks and ordered medically unnecessary tests. The settlement of 30 million USD is a joint payment by all settling parties; the laboratory entered into a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Original amount 30,000,000 USD, converted at the ECB reference rate of 17 Jun 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Monash IVF collected sensitive information about visitors to its fertility treatment website through third-party tracking pixels. The Privacy Commissioner held that following the visitors of health-related websites and afterwards showing them targeted adverts on social networks amounts to collecting sensitive data, which requires consent, and found breaches of APP 3.3, 5.1, 5.2 and 7.1. Monash IVF must not continue or repeat the conduct and must implement specified remedial steps; a parallel determination against the telehealth provider Medmate Australia was made on the same day.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Cookies and tracking

Legal basis

Privacy Act 1988 (Cth), APP 3.3, 5.1, 5.2, 7.1

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

24 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

In November 2018 attackers encrypted patient data in the laboratory information system of Midlands Regional Hospital Tullamore. The DPC found that the HSE had infringed Art. 5(1)(f), 28, 30, 32(1) and 34 GDPR (including insufficient security, deficient processor contracts and record of processing, and incomplete notification of affected persons), issued a reprimand, imposed €300,000 for the security failings (Art. 5(1)(f) and 32(1)) and ordered it to introduce specified policies and procedures for secure processing.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 28, 30, 32(1), 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 2 Oct 2026 · Direct link

The non-profit hospital group Ascension wanted to acquire AmSurg for 3.9 billion USD. Owing to overlaps in outpatient surgery in five regions, the Federal Trade Commission (FTC) requires the sale of seven AmSurg centres to SC Affiliates and a gastroenterology practice, as well as transitional support.

Authority / court

Federal Trade Commission (FTC)

Area of law

Competition law · Merger control

Legal basis

Section 7 Clayton Act; Section 5 FTC Act (Consent Order)

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The security shortcomings were remedied after the inspections.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Californian provider of mobile PET scans allegedly paid referring cardiologists excessive fees for supervising the examinations in order to secure referrals. The settlement of 8,334,350.71 USD plus revenue-based payments is based on ability to pay; in addition, there is a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice / U.S. Attorney's Office, Central District of California

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 8,334,350.71 USD, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following an investigation by SafeWork NSW, the District Court of NSW fined LiveBetter Services Limited 675,000 AUD for a breach of ss 32/19(2) of the Work Health and Safety Act 2011. In February 2022, a participant in the National Disability Insurance Scheme (NDIS) was placed in a bath with excessively hot water, suffered serious burns and died from her injuries.

Authority / court

SafeWork NSW

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Work Health and Safety Act 2011 (NSW) ss 32/19(2)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Original amount 675,000 AUD, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Four laboratories and their association coordinated negotiations on prices with health insurers, coordinated in tenders, exchanged sensitive information and allocated customers. At first instance, the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 14,551,800 EUR and three-year procurement bans; Unilabs received a substantially reduced fine as leniency applicant and under a settlement.

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Kartellverbot)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Unilabs: leniency reduction (50%) and settlement (a further 30%).

Published

12 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data processors

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In parallel with the US declination, the PNF concluded a CJIP with the US subsidiary of the French medical technology manufacturer for 1,765,493 EUR (after crediting the US disgorgement) and a three-year AFA compliance programme. The case arose from Balt SAS's voluntary self-disclosure of 22 May 2023 concerning conduct at the acquired company Blockade Medical.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); aktive und passive Bestechung von Amtsträgern

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

250 to 999

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure to the PNF and the DOJ; coordinated resolution with crediting.

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

19 Mar 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Through sham consultancy agreements, fictitious invoices and purported bonus payments, around 602,000 USD in bribes flowed from 2017 to 2023 via a Belgian consultant to a physician in a senior position at a French public hospital, so that the hospital would purchase embolisation coils from Balt. The DOJ declined to prosecute on account of voluntary self-disclosure, cooperation and remediation (declination of 17 March 2026); Balt is disgorging 1,214,797 USD in profits.

Authority / court

U.S. Department of Justice (Criminal Division, Fraud Section)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

FCPA; Corporate Enforcement and Voluntary Self-Disclosure Policy (Declination)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure (including to the French national financial prosecutor's office, PNF), full cooperation, timely remediation, disciplinary measures, parallel resolution in France.

Liability of senior managers

Measures against individuals are not reported here.

Published

19 Mar 2026

Original amount 1,214,797 USD, converted at the ECB reference rate of 17 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Between January and June 2023, the Sarasota laboratory paid independent marketers to steer laboratory samples from Medicare beneficiaries to it. It self-disclosed the conduct, cooperated extensively and paid 980,000 USD.

Authority / court

U.S. Attorney's Office, Middle District of Florida

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Voluntary self-disclosure, detailed disclosure and cooperation.

Original amount 980,000 USD, converted at the ECB reference rate of 5 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The clinic’s managing director himself reported that a former employee had copied contact details and patient records of all patients and poached them for a new clinic. In the subsequent investigation, the clinic did not fully answer the requests of the Romanian data protection authority (ANSPDCP) despite a reprimand and an order; the authority therefore imposed 10,190 lei (2,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in February 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Feb 2026

Original amount 10,190 RON, converted at the ECB reference rate of 20 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following the tragedy at the Lapu-Lapu Day festival in 2025, 36 employees of three health authorities accessed patient data of 16 admitted persons without authorisation in 71 instances. Those affected were not informed without undue delay; the Information and Privacy Commissioner for British Columbia (OIPC BC) made nine recommendations, including automated access monitoring and deterrent disciplinary measures.

Authority / court

Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Area of law

Data protection · Data breaches and data security

Legal basis

Freedom of Information and Protection of Privacy Act (FIPPA) BC, s. 25.1

Action

Other

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Appropriate safeguards were in place; the authorities responded quickly and accepted all recommendations.

Published

18 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

The two companies colluded in tenders of the General Health Insurance Company for the supply of medicines (2017–2020). For the first time, a cartel was uncovered on the basis of information from a whistleblower; the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 7,595,200 EUR and a one-year procurement ban on PHOENIX and 201,800 EUR and a three-year procurement ban on TRANSMEDIC (first instance).

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Submissionsabsprache)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

PHOENIX: settlement with a 30% fine reduction and a shortened procurement ban.

Published

24 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

The hospital (until 2015 Hudson Valley Hospital Center) allegedly paid an oncology practice in Westchester millions of dollars to induce it to refer patients to the hospital; the hospital billed the services to Medicare and Medicaid. The U.S. Attorney’s Office filed a complaint and at the same time concluded a settlement of 6.8 million USD.

Authority / court

U.S. Attorney's Office, Southern District of New York

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 6,800,000 USD, converted at the ECB reference rate of 22 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

According to the FTC, the telemedicine company advertised GLP-1 weight-loss programmes with monthly prices that did not include medication, laboratory costs and medical consultations, concealed the minimum term and cancellation fees, published fake testimonials from employees and relatives, and induced customers to delete negative reviews by offering vouchers or refunds. Under the final settlement order, the company is paying 150,000 USD jointly with other liable parties (joint payment), which is earmarked for refunds.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Section 5 FTC Act; Restore Online Shoppers' Confidence Act (ROSCA)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Published

3 Dec 2025

Original amount 150,000 USD, converted at the ECB reference rate of 3 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

A hospital of the group had removed from its archive earlier MRI scans that a patient had brought in for comparison once an internal collection period had expired, so that they were no longer available. The AEPD imposed 100,000 EUR each for processing health data without a legal basis (Art. 9 and Art. 6) and 1,000,000 EUR for lack of data protection by design in the procedure (Art. 25), 1,200,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6, 9, 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Mar 2026

Checked against the official source on 28 Sep 2026 · Direct link

An assessment following several security compromises found that the laboratory company had notified neither the Information Regulator nor the affected data subjects. After an enforcement notice that it failed to comply with, it received an infringement notice with an administrative fine of ZAR 100,000, which has since been paid.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Data breaches and data security

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA), s. 22

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

13 Nov 2025

Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Doctolib tied doctors with exclusivity clauses, bundled telemedicine with the appointment booking subscription and in 2018 acquired its main competitor in order to eliminate it (decision 25-D-06). Fines: 4.615 million EUR for exclusivity and tying, 50,000 EUR for the acquisition.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV, Art. L.420-2 Code de commerce

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Culpability

intentional

Published

6 Nov 2025

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Despite access requests, two patients did not receive copies of their scan files at the end of treatment; the practice responded only sluggishly to enquiries and did not attend an appointment with the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered disclosure under Art. 15(3) GDPR or a reasoned refusal and threatened a penalty payment of 2,000 EUR.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. c, Art. 12 Abs. 4, Art. 15 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

On the application of the Australian Information Commissioner, the Federal Court of Australia imposed the first civil penalties under the Privacy Act 1988: Australian Clinical Labs (ACL) had failed to adequately protect the personal information held on the IT systems of its Medlab Pathology business; in a cyberattack in February 2022, data of more than 223,000 people was taken from those systems. The penalty of 5.8 million AUD in total comprises 4.2 million AUD for the inadequate security measures (APP 11.1), 800,000 AUD because ACL did not assess reasonably and promptly whether a notifiable data breach had occurred, and 800,000 AUD for the late notification to the Commissioner. ACL admitted the contraventions; liability and the penalty were allegedly based on joint submissions by the parties.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act 1988 (Cth) s 13G(a) i. V. m. APP 11.1; s 26WH(2); s 26WK(2)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

Cooperation with the investigation, an ongoing programme to uplift cyber security, apologies and admission of liability.

Liability of senior managers

The court found that the most senior management was involved in the decisions on integrating the Medlab systems and on assessing the attack.

Published

9 Oct 2025

Original amount 5,800,000 AUD, converted at the ECB reference rate of 8 Oct 2025.

Checked against the official source on 3 Oct 2026 · Direct link

For almost six years, the chair of the management board of the medical company was also its data protection officer; this came to light after a report that a patient had been handed documents relating to another person. Poland’s data protection authority (UODO) found a conflict of interest and imposed 11,365 PLN.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 6 DSGVO (DKN.5131.7.2025)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

An independent external data protection officer was appointed in July 2024.

Published

29 Sep 2025

Original amount 11,365 PLN, converted at the ECB reference rate of 12 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

A practice for aesthetic treatments advertised hyaluronic acid filler injections for the nose and chin on its website and on Instagram using before-and-after images. In an action brought by a consumer advice centre (Verbraucherzentrale), the BGH upheld the injunction issued by the Higher Regional Court of Hamm (OLG Hamm): such procedures are deemed to be surgical cosmetic procedures, for which this kind of advertising is prohibited.

Authority / court

Bundesgerichtshof (I. Zivilsenat), Az. I ZR 170/24

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 11 Abs. 1 Satz 3 Nr. 1, § 1 Abs. 1 Nr. 2 Buchst. c HWG; UKlaG

Action

Order

Status of proceedings

final

Sector

Healthcare

Published

31 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

The Minnesota provider of outpatient addiction treatment pays USD 18,500,000 to resolve False Claims Act allegations and entered into a five-year Corporate Integrity Agreement with HHS-OIG. According to the US Attorney's Office, from January 2019 to February 2025 NUWAY compensated Medicaid patients for attending intensive outpatient treatment and also billed services in which the same period of time was counted twice. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Attorney's Office, District of Minnesota (U.S. Department of Justice)

Area of law

Bribery and corruption · Gifts, hospitality and benefits

Legal basis

False Claims Act; Anti-Kickback Statute

Action

Other

Status of proceedings

final

Sector

Healthcare

Published

26 Jun 2025

Original amount 18,500,000 USD, converted at the ECB reference rate of 26 Jun 2025.

Checked against the official source on 3 Oct 2026 · Direct link

From April to September 2023, attackers used reused credentials to access data on 155,592 people in the United Kingdom, including ancestry, family trees and health information. There was no MFA, no secure password rules and no effective monitoring; despite anomalies in July 2023, the full investigation only began in October. Joint investigation by the UK Information Commissioner's Office (ICO) with the Privacy Commissioner of Canada.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Employees

250 to 999

Culpability

negligent

Published

17 Jun 2025

Original amount 2,310,000 GBP, converted at the ECB reference rate of 5 Jun 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2018–2022, the online pharmacy transmitted purchase data, including data on prescription medicines, to the tracking providers via Google and Meta tracking. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.1 million EUR and a reprimand; on 1 June 2026 the Helsingin hallinto-oikeus (Helsinki Administrative Court) upheld the infringement but annulled the fine because it was unclear whether a fine may be imposed on the university pharmacy at all (not final).

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio; Helsingin hallinto-oikeus

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 9, Art. 25, Art. 32

Action

Fine

Status of proceedings

overturned

Sector

Healthcare

Published

4 Jun 2025

Amount in EUR; no ECB reference rate is available for this currency.

Checked against the official source on 25 Sep 2026 · Direct link

The CADE Tribunal convicted the federal council of physiotherapists and occupational therapists because, through resolutions, rulings and annually updated reference tables, it had set binding minimum prices for the services of members of the profession and thereby encouraged uniform market conduct. In addition to a fine of 3,103,583.65 BRL, COFFITO must refrain from binding price tables, remove all references to them from its websites (penalty of 5,000.00 BRL per day) and publish the decision on its website and social media; proceedings against the regional council for the 15th region are suspended owing to a settlement. The amount and the facts have not been confirmed against the primary source.

Authority / court

Conselho Administrativo de Defesa Econômica (CADE), Tribunal Administrativo

Area of law

Competition law · Cartels and collusion

Legal basis

Lei nº 12.529/2011; Art. 38 und 39 (Nebenanordnungen)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

10 Apr 2025

Original amount 3,103,583.65 BRL, converted at the ECB reference rate of 9 Apr 2025.

Checked against the official source on 3 Oct 2026 · Direct link

Despite being asked to do so, a healthcare provider (name redacted) did not correct a patient’s address, so that health reports were sent to third parties, and used address data from the electoral register without a legal basis. The Information and Data Protection Commissioner (IDPC) issued a reprimand, ordered rectification, erasure of the register data and the designation of a data protection officer, and imposed fines of 12,500, 5,000 and 2,500 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und d, Art. 6 Abs. 1, Art. 14, 16, 37 Abs. 1 lit. c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

The Markkinaoikeus (Market Court, Finland) imposed a penalty payment of 1,500,000 EUR on the care services provider Attendo Suomi Oy for obstructing an unannounced inspection by the competition authority in January 2023: after the inspection had begun, a manager deleted chat histories and the call log on a mobile phone also used for work. It was the first penalty for such a procedural infringement in Finland; the authority had sought 4,373,760 EUR, but the court gave considerably more weight to Attendo's own measures, including the swift restoration of the deleted chats.

Authority / court

Markkinaoikeus (Marktgericht) auf Antrag des Kilpailu- ja kuluttajavirasto (KKV)

Area of law

Competition law

Legal basis

Kilpailulaki (948/2011) 37 a § 1 mom. 1 kohta i. V. m. 35 § und 37 §

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Training and instructions for staff on conduct during inspections already before the incident; swift restoration and handover of the deleted chats from a backup; no advantage gained and no earlier penalties for procedural infringements.

Published

31 Mar 2025

Checked against the official source on 28 Sep 2026 · Direct link

Following a tip-off from the Military Medical Academy (VMA), the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found that the centre presented its gynaecological practice as a VMA branch with signs reading ‘МЦ „ЛЮЛИН МЕД“ АГ – ВМА ФИЛИАЛ’ and corresponding online information. For misleading conduct (Art. 31 ZZK – Bulgarian Protection of Competition Act) it imposed 0.4% of 2023 turnover, i.e. 9,236 leva. An appeal has been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 31 ZZK (Irreführung)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Original amount 9,236 BGN, converted at the ECB reference rate of 6 Feb 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Bard and three affiliated companies pay USD 17 million to resolve allegations under the federal False Claims Act and several state statutes. Between 2016 and February 2020 they allegedly gave urology practices discounts, excessive free samples and savings on office supplies so that they would prescribe intermittent catheters by default using Bard's own “Link” prescription form; no liability was determined.

Authority / court

U.S. Attorney's Office, Northern District of Georgia (U.S. Department of Justice)

Area of law

Bribery and corruption · Gifts, hospitality and benefits

Legal basis

False Claims Act; Anti-Kickback Statute (42 U.S.C. § 1320a-7b); False-Claims-Gesetze mehrerer Bundesstaaten

Action

Other

Status of proceedings

final

Sector

Healthcare

Published

23 Jan 2025

Original amount 17,000,000 USD, converted at the ECB reference rate of 23 Jan 2025.

Checked against the official source on 3 Oct 2026 · Direct link

The Controladoria-Geral da União (CGU, Office of the Comptroller General) imposed on the Associação da Irmandade da Santa Casa de Misericórdia de Pacaembu, an association operating as a healthcare social organisation (Organização Social), a fine of BRL 47,391,386.87, extraordinary publication of the decision and a declaration of unsuitability for public contracts. According to the final report, the association rigged the selection procedure for managing the Hangar field hospital in Belém (Pará), committed fraud in performing the management contract for a regional hospital in Belém and used front persons and companies to conceal its real interests.

Authority / court

Controladoria-Geral da União (CGU)

Area of law

Bribery and corruption

Legal basis

Lei nº 12.846/2013, Art. 5 III und IV b und d, Art. 6, Art. 14; Lei nº 8.666/1993, Art. 87 IV und Art. 88 II und III

Action

Fine

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not set out here.

Published

28 Jan 2025

Original amount 47,391,386.87 BRL, converted at the ECB reference rate of 23 Jan 2025.

Checked against the official source on 3 Oct 2026 · Direct link

Following a ransomware attack in 2021 – the second after an attack in 2019 – the Litigation Chamber found that a Belgian hospital had, among other things, no data protection impact assessment, no effective information security policy, no adequate procedure for security updates of its software and no genuine training and awareness programme for staff. On 17 December 2024 it imposed a fine of 200,000 EUR, ordered remedial measures and rejected the argument that, as a public body, the hospital could not be fined. On 3 September 2025 the Market Court partially annulled the decision and reduced the fine to 50,000 EUR; the data protection authority has lodged an appeal in cassation against that judgment. The decision is not final. The amount and the facts have not been confirmed against the primary source.

Authority / court

Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 24, Art. 32 und Art. 35 Abs. 3 DSGVO; Art. 58 Abs. 2 lit. d und i sowie Art. 83 DSGVO; Art. 100 § 1 9° und 13° sowie Art. 101 LCA

Action

Fine

Status of proceedings

reduced

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The Chamber reduced the starting amount of 390,000 EUR to 200,000 EUR, mainly because of the hospital's financial difficulties, the Covid-19 crisis as a mitigating circumstance and a reassessed duration of the infringement.

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

The medical technology manufacturer misled investors about regulatory risks of the Alaris infusion pump, which had more than 25 software defects, and did not record the remediation costs, as a result of which operating income in the fourth quarter of 2019 was overstated by 82 %. BD is paying 175 million USD and must appoint an independent compliance consultant.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Antifraud-, Reporting-, Buchführungs-, interne Kontroll- und Disclosure-Controls-Vorschriften der US-Wertpapiergesetze

Action

Fine

Status of proceedings

final

Sector

Healthcare

Original amount 175,000,000 USD, converted at the ECB reference rate of 16 Dec 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to United Lincolnshire Teaching Hospitals NHS Trust. The ICO found that between March 2021 and March 2022 the trust failed to answer 32% of subject access requests within the one-month statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Employees

1,000 to 9,999

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Californian hospital pays USD 10,250,000 (USD 9,518,954 to the federal government, USD 731,046 to the State of California) and entered into a five-year Corporate Integrity Agreement with HHS-OIG. The allegations were that it paid doctors who decided on inpatient admissions bonuses based on the number of patients admitted, billed medically unnecessary inpatient admissions and used false diagnosis codes for SIRS. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Attorney's Office, Eastern District of California (U.S. Department of Justice)

Area of law

Bribery and corruption · Commercial bribery

Legal basis

False Claims Act; Anti-Kickback Statute

Action

Other

Status of proceedings

final

Sector

Healthcare

Published

12 Dec 2024

Original amount 10,250,000 USD, converted at the ECB reference rate of 12 Dec 2024.

Checked against the official source on 3 Oct 2026 · Direct link

A limited company operating a diagnostic laboratory (name pseudonymised), which during the pandemic carried out up to 45,000 PCR analyses a day with around 200 employees, had appointed its managing director as data protection officer at the same time. Because of the resulting conflict of interest, the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 5,000 EUR; the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection

Legal basis

Art. 37, Art. 38 Abs. 6 DSGVO

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

50 to 249

Liability of senior managers

The managing director was also appointed as data protection officer – an impermissible conflict of interest.

Checked against the official source on 25 Sep 2026 · Direct link

A Danish non-profit health organisation reported thefts of computers from its offices as well as phishing attacks in 2019 and 2020; according to the Danish Data Protection Agency (Datatilsynet), at least 1,448 people were affected, some with health data. Although the organisation itself had considered multi-factor authentication necessary after an attack in 2018, this and encryption of the computers were lacking. A Danish city court issued a final judgment ordering it to pay 75,000 DKK (Datatilsynet's recommendation and the prosecution's request: 800,000 DKK).

Authority / court

Københavns Byret (auf Anzeige der Datatilsynet)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1; databeskyttelsesloven § 41

Action

Fine

Status of proceedings

final

Sector

Healthcare

Repeat case

yes

Original amount 75,000 DKK, converted at the ECB reference rate of 1 Oct 2024.

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 1 Oct 2026 · Direct link

At one of the provider's care facilities, part of a resident's paper file was lost, which came to light during a special audit in August 2021. Although staff considered the incident notifiable and the health board and later the Health and Disability Commissioner (health complaints authority) urged notification, the company only informed the Office of the Privacy Commissioner (OPC, New Zealand's data protection authority) in October 2023. On 24 September 2024 the Privacy Commissioner found a breach of the notification duty and poor document management and named the company publicly.

Authority / court

Office of the Privacy Commissioner (OPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act 2020, s 114

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Constructive engagement; introduction of an electronic document management system with access controls, staff training, a privacy breach management plan and a revised management structure.

Published

24 Sep 2024

Checked against the official source on 7 Oct 2026 · Company name anonymised since 24 Sep 2026 · Direct link

The Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) examined several complaints against the state hospital, including about the processing of patient and health data by a physician assistant and about an unanswered access request. Because the hospital did not provide the requested information, the authority imposed 2,000 EUR for breach of the duty to cooperate.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Sep 2026 · Direct link

In 2019, a specialist hospital in the Rijeka area (name not published) irretrievably lost patients’ radiological images because it did not make backup copies, and did not report the incident although management had been informed. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) imposed 190,000 EUR, including for a missing data processing agreement, call recordings without a legal basis and failure to involve the data protection officer.

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 6, 12, 13, 28 Abs. 3, 32 Abs. 1 lit. b, 33 Abs. 1, 38 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

13 Sep 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 13 Sep 2026 · Direct link

Between July 2019 and July 2023, the healthcare company had employees waive potential awards for reports to authorities in 98 employment, separation, retention and settlement agreements; in 56 further separation and settlement agreements, they had to waive complaints to federal authorities. As part of a sweep against seven listed companies, the company paid 1,386,000 US dollars to the U.S. Securities and Exchange Commission (SEC); the contract templates were amended.

Authority / court

U.S. Securities and Exchange Commission

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Securities Exchange Act of 1934, Rule 21F-17(a)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Partial amendment of the templates even before contact by the SEC, information provided to those affected, and cooperation

Published

9 Sep 2024

Original amount 1,386,000 USD, converted at the ECB reference rate of 9 Sep 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 Sep 2026 · Direct link

The CNIL (French data protection authority) fined a French medical software provider EUR 800,000 because patient data were processed via its practice software for a health database without the authorisation required by Art. 66 of the Loi Informatique et Libertés (French Data Protection Act), and because data were also collected from the health insurance teleservice HRi, which only doctors may access (Art. 5(1)(a) GDPR). On 13 February 2026 the Conseil d'État (French supreme administrative court) dismissed the company's appeal and confirmed that the pseudonymised data are personal data because of the risk of re-identification.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 5 Abs. 1 lit. a DSGVO

Action

Fine

Status of proceedings

final

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The company filed the required authorisation applications during the proceedings; no order was therefore issued.

Published

12 Sep 2024

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 5 Sep 2026 · Direct link

The Integritetsskyddsmyndigheten (IMY, Swedish data protection authority) fined the pharmacy chain 37,000,000 SEK because, between 19 January 2020 and 25 April 2022, the company had not taken appropriate technical and organisational measures when using the Meta Pixel analytics tool on its website. Through the activated advanced matching function, contact details including personal identity numbers in hashed form, together with details of purchased, partly sensitive products, reached Meta when purchases were made; according to the incident report, an estimated 500,001 to 1,000,000 people were affected. The pharmacy chain learned of this through a tip-off from an outside party; the fine was based on its 2023 annual turnover of 23.27 billion SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO; Art. 58 Abs. 2 und Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

In assessing seriousness, IMY took into account that the data went in hashed form to a single recipient and that security measures were already in place; it treated notification, cooperation and subsequent remediation as neutral.

Original amount 37,000,000 SEK, converted at the ECB reference rate of 29 Aug 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 29 Aug 2026 · Direct link

The CNIL (French data protection authority) fined a statistics company belonging to a French corporate group EUR 800,000 because it operated two databases containing health data from medical practices and from pharmacies without the authorisation required by Art. 66 of the Loi Informatique et Libertés (French Data Protection Act); at the end of March 2021 they held data on 13.4 million medical consultations with 4 million patient codes and around 78 million identifiers respectively. On 13 February 2026 the Conseil d'État (French supreme administrative court) dismissed the appeal, holding that the data were only pseudonymised and therefore personal data.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The company filed the required authorisation applications during the proceedings; no order was therefore issued.

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 28 Aug 2026 · Direct link

The Texas Attorney General's office concluded an Assurance of Voluntary Compliance with a Texas-based provider of generative AI for hospitals and submitted it to the court for approval. The provider had advertised the accuracy of its software, which summarises patient data for hospital staff, including with a 'severe hallucination' rate of less than 1 in 100,000; the authority considered these metrics likely to be inaccurate and misleading. For five years the provider must clearly explain such metrics in its advertising or have them substantiated by an independent auditor, and must disclose to its customers the risks, limitations and appropriate use of its products; the company denies any wrongdoing, and no payment is provided for.

Authority / court

Office of the Attorney General of Texas, Consumer Protection Division

Area of law

AI and digital regulation · AI systems

Legal basis

Texas Deceptive Trade Practices–Consumer Protection Act (DTPA), Tex. Bus. & Com. Code §§ 17.41–17.63; Zusicherung nach § 17.58

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

18 Sep 2024

Checked against the official source on 8 Oct 2026 · Company name anonymised since 21 Aug 2026 · Direct link

The dialysis group allegedly paid kickbacks to promote referrals to its former pharmacy subsidiary and granted benefits to nephrologists and vascular surgeons to induce them to send patients to the group's dialysis centres. The group paid 34,487,390 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Employees

10,000 or more

Original amount 34,487,390 USD, converted at the ECB reference rate of 18 Jul 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Jul 2026 · Direct link

Three home health agencies in Texas, Ohio and Indiana and their parent company allegedly granted kickbacks to assisted living facilities and physicians for Medicare referrals. They paid 4,496,330 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 4,496,330 USD, converted at the ECB reference rate of 1 Jul 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 1 Jul 2026 · Direct link

At the care facility, employees worked up to 24 hours a day, seven days a week, were not allowed to leave the premises, had to work through breaks and received no overtime pay. The settlement of 658,948 USD comprises 608,948 USD for 34 employees (including overtime and break premiums) and 50,000 USD in civil penalties.

Authority / court

California Labor Commissioner's Office (Division of Labor Standards Enforcement)

Area of law

Health and safety and employment law · Working time

Legal basis

California Labor Code (Überstunden, Meal and Rest Periods, Mindestlohn)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 658,948 USD, converted at the ECB reference rate of 12 Jun 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Jun 2026 · Direct link

The medical corporation promised people attending an internal medicine clinic it operates for a flu vaccination a reduction in the vaccination fee if they rated the clinic with five or four stars on Google Maps. Consumers could not recognise the resulting reviews as advertising prompted by the provider; the order required it to stop displaying them, inform consumers and take preventive measures that also cover the medical staff.

Authority / court

Consumer Affairs Agency (消費者庁, CAA)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Art. 7 Abs. 1 i. V. m. Art. 5 Nr. 3 (Bekanntmachung zu Stealth-Marketing) Act against Unjustifiable Premiums and Misleading Representations (不当景品類及び不当表示防止法, Gesetz Nr. 134/1962)

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

7 Jun 2024

Checked against the official source on 8 Oct 2026 · Company name anonymised since 6 Jun 2026 · Direct link