Who was sanctioned, and for what?

Hospital staff opened a colleague's electronic health record to organise duty rosters during Covid rather than for treatment purposes. Technical barriers limiting access to treating staff were lacking; the Italian data protection authority (Garante per la protezione dei dati personali) imposed 24,000 EUR (Provvedimento No. 616).

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Employee data

Legal basis

Art. 5 Abs. 1 lit. a, b, c, f, Art. 9, 25, 32 DSGVO; Art. 75 Codice privacy; Linee guida dossier sanitario

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

11 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The neurotechnology company from Dallas, described by the Bureau of Industry and Security (BIS, the export control agency of the US Department of Commerce) as small, delivered neural data acquisition systems (“OmniPlex”) and accessories worth around 179,000 USD on eight occasions in 2022/23 via its Asian distributor to the Chinese Academy of Military Medical Sciences, which has been on the Entity List (the US export control list of restricted parties) since December 2021. The penalty of 1.7 million USD is suspended for five years and then waived, provided that Plexon submits an external audit of its export compliance programme on time and commits no further violations; a five-year denial of export privileges is likewise suspended, and Plexon must also provide export control training.

Authority / court

U.S. Department of Commerce, Bureau of Industry and Security (BIS)

Area of law

Sanctions and export control · Export control and dual-use goods

Legal basis

Export Administration Regulations, 15 C.F.R. § 764.2(a), § 744.11

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Penalty and denial of export privileges fully suspended for five years, conditional on an external export control audit.

Published

14 Aug 2026

Original amount 1,700,000 USD, converted at the ECB reference rate of 14 Aug 2026.

Checked against the official source on 28 Sep 2026 · Direct link

The Houston laboratory allegedly paid kickbacks and billed Medicare and Medicaid for medically unnecessary genetic tests. The settlements with the laboratory and other parties add up to 36.4 million USD (combined total); the laboratory is subject to a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Original amount 36,400,000 USD, converted at the ECB reference rate of 30 Jul 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

In summer 2025, an attacker gained access to the private hospital's electronic patient record system and obtained data on 524,867 patients and 202,246 trusted persons. There was no VPN or multi-factor authentication for external users, no appropriate access control and no detection of suspicious activity; the trusted persons were not notified. France's data protection authority (Commission nationale de l'informatique et des libertés, CNIL) imposed a fine of 500,000 EUR (SAN-2026-009).

Authority / court

Commission nationale de l'informatique et des libertés (CNIL)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32, Art. 34

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

3 Sep 2026

Checked against the official source on 25 Sep 2026 · Direct link

The Florida laboratory provided referring physicians with consulting services below market value and paid independent consultants referral-based remuneration for recruiting physicians. Following a self-disclosure, NeoGenomics paid 9,813,260 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Self-disclosure of the remuneration arrangements.

Original amount 9,813,260 USD, converted at the ECB reference rate of 20 Jul 2026.

Checked against the official source on 25 Sep 2026 · Direct link

From May to the end of August 2024, the public hospital accidentally published on its website a surgery list containing patients' telephone numbers, illnesses and planned procedures; a member of the public found the document via Google. The Hellenic Data Protection Authority imposed a total of 25,000 EUR: 10,000 EUR for inadequate security, 2,000 EUR for the late notification, 10,000 EUR for failing to notify the data subjects and 3,000 EUR for missing contact details of the data protection officer (DPO).

Authority / court

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 5 Abs. 1 lit. f, 32 Abs. 1, 33 Abs. 1, 34 Abs. 1, 12, 13 i. V. m. 37 (Entscheidung 13/2026)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

On application by a competitor, the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) established that the laboratory had offered packages of medical laboratory tests free of charge nationwide over extended periods (only against a fee of 2 leva for taking blood) – conduct shown by no other market participant outside joint campaigns. It found an infringement of the general clause of unfair competition law (Art. 29 ZZK – Bulgarian Protection of Competition Act) and imposed 0.3% of 2024 turnover, i.e. 52,096.55 EUR. Appeals have been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Competition law

Legal basis

Art. 29 ZZK (Generalklausel unlauterer Wettbewerb)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Published

2 Jul 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In the teaching hospital's virology laboratory, the lid of a centrifuge fell on an employee who had to hold it open by hand because of a defective gas spring; she was seriously injured. Maintenance reports from 2023 and 2024 had already called for the spring to be replaced. Fine of CA$65,000 plus victim fine surcharge.

Authority / court

Provincial Offences Court Hamilton (Ermittlung: Ontario Ministry of Labour, Immigration, Training and Skills Development)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 25(1)(b) Occupational Health and Safety Act (Ontario)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Guilty plea; repair two days after the accident.

Published

21 Jul 2026

Original amount 65,000 CAD, converted at the ECB reference rate of 18 Jun 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The Arkansas pathology laboratory and its management company allegedly granted unlawful kickbacks and ordered medically unnecessary tests. The settlement of 30 million USD is a joint payment by all settling parties; the laboratory entered into a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Original amount 30,000,000 USD, converted at the ECB reference rate of 17 Jun 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Monash IVF collected sensitive information about visitors to its fertility treatment website through third-party tracking pixels. The Privacy Commissioner held that following the visitors of health-related websites and afterwards showing them targeted adverts on social networks amounts to collecting sensitive data, which requires consent, and found breaches of APP 3.3, 5.1, 5.2 and 7.1. Monash IVF must not continue or repeat the conduct and must implement specified remedial steps; a parallel determination against the telehealth provider Medmate Australia was made on the same day.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Cookies and tracking

Legal basis

Privacy Act 1988 (Cth), APP 3.3, 5.1, 5.2, 7.1

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

24 Jun 2026

Checked against the official source on 3 Oct 2026 · Direct link

In November 2018 attackers encrypted patient data in the laboratory information system of Midlands Regional Hospital Tullamore. The DPC found that the HSE had infringed Art. 5(1)(f), 28, 30, 32(1) and 34 GDPR (including insufficient security, deficient processor contracts and record of processing, and incomplete notification of affected persons), issued a reprimand, imposed €300,000 for the security failings (Art. 5(1)(f) and 32(1)) and ordered it to introduce specified policies and procedures for secure processing.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 28, 30, 32(1), 34 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 2 Oct 2026 · Direct link

The non-profit hospital group Ascension wanted to acquire AmSurg for 3.9 billion USD. Owing to overlaps in outpatient surgery in five regions, the Federal Trade Commission (FTC) requires the sale of seven AmSurg centres to SC Affiliates and a gastroenterology practice, as well as transitional support.

Authority / court

Federal Trade Commission (FTC)

Area of law

Competition law · Merger control

Legal basis

Section 7 Clayton Act; Section 5 FTC Act (Consent Order)

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Employees

10,000 or more

Checked against the official source on 25 Sep 2026 · Direct link

The CNIL (French data protection authority) fined IQVIA Operations France EUR 5,000,000 because, for two health data warehouses authorised by the CNIL (fed with data from around 14,000 pharmacies and several thousand medical practices), the company did not comply with the conditions of the authorisations, including log analysis, multi-factor authentication, patient information and the right to object. In addition, pharmacy customers were not informed of the transfer of their data, in-house studies were carried out without the required authorisation and the pharmacy software transmitted data even after a refusal (Art. 25 GDPR). The CNIL classified the data as pseudonymised rather than anonymous and ordered remedial action within six months, subject to a penalty payment of EUR 10,000 per day.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 14 und 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The security shortcomings were remedied after the inspections.

Published

28 May 2026

Checked against the official source on 2 Oct 2026 · Direct link

The Californian provider of mobile PET scans allegedly paid referring cardiologists excessive fees for supervising the examinations in order to secure referrals. The settlement of 8,334,350.71 USD plus revenue-based payments is based on ability to pay; in addition, there is a Corporate Integrity Agreement.

Authority / court

U.S. Department of Justice / U.S. Attorney's Office, Central District of California

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 8,334,350.71 USD, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following an investigation by SafeWork NSW, the District Court of NSW fined LiveBetter Services Limited 675,000 AUD for a breach of ss 32/19(2) of the Work Health and Safety Act 2011. In February 2022, a participant in the National Disability Insurance Scheme (NDIS) was placed in a bath with excessively hot water, suffered serious burns and died from her injuries.

Authority / court

SafeWork NSW

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Work Health and Safety Act 2011 (NSW) ss 32/19(2)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Original amount 675,000 AUD, converted at the ECB reference rate of 30 Apr 2026.

Checked against the official source on 3 Oct 2026 · Direct link

Four laboratories and their association coordinated negotiations on prices with health insurers, coordinated in tenders, exchanged sensitive information and allocated customers. At first instance, the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 14,551,800 EUR and three-year procurement bans; Unilabs received a substantially reduced fine as leniency applicant and under a settlement.

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Kartellverbot)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Unilabs: leniency reduction (50%) and settlement (a further 30%).

Published

12 May 2026

Checked against the official source on 25 Sep 2026 · Direct link

The starting point was a complaint about incomplete disclosure of patient data; the clinic left several requests from the supervisory authority unanswered. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered it to revise its contracts with Align Technology (Invisalign) with regard to the GDPR roles (Art. 26/28 GDPR), to adapt the consent form and the privacy notices in accordance with Art. 7, 9, 13 and 14 GDPR and to publish them in Estonian; non-compliance is subject to a penalty payment of 1,000 EUR per item.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data processors

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. d DSGVO i. V. m. Art. 5 Abs. 1 lit. a, 7, 9, 13, 14, 26, 28 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

A general practitioner who had no longer been treating the complainant since January 2023 accessed his health data (findings, prescriptions) on the national e-health platform EESZT a total of 47 times via his practice software until August 2024 and did not respond to an access request. The Hungarian data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH) found infringements of Art. 5(2), 6(1), 9(2), 12(2) and 15(1) GDPR, ordered compliance with the access request and imposed 500,000 HUF.

Authority / court

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)

Area of law

Data protection · Data subject rights and transparency

Legal basis

DSGVO Art. 5 Abs. 2, 6 Abs. 1, 9 Abs. 2, 12 Abs. 2, 15 Abs. 1

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

20 Mar 2026

Original amount 500,000 HUF, converted at the ECB reference rate of 20 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In parallel with the US declination, the PNF concluded a CJIP with the US subsidiary of the French medical technology manufacturer for 1,765,493 EUR (after crediting the US disgorgement) and a three-year AFA compliance programme. The case arose from Balt SAS's voluntary self-disclosure of 22 May 2023 concerning conduct at the acquired company Blockade Medical.

Authority / court

Parquet national financier (PNF); Validierung durch den Präsidenten des Tribunal judiciaire de Paris

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

Art. 41-1-2 Code de procédure pénale (CJIP); aktive und passive Bestechung von Amtsträgern

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

250 to 999

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure to the PNF and the DOJ; coordinated resolution with crediting.

Liability of senior managers

The CJIP does not address the criminal liability of natural persons.

Published

19 Mar 2026

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Through sham consultancy agreements, fictitious invoices and purported bonus payments, around 602,000 USD in bribes flowed from 2017 to 2023 via a Belgian consultant to a physician in a senior position at a French public hospital, so that the hospital would purchase embolisation coils from Balt. The DOJ declined to prosecute on account of voluntary self-disclosure, cooperation and remediation (declination of 17 March 2026); Balt is disgorging 1,214,797 USD in profits.

Authority / court

U.S. Department of Justice (Criminal Division, Fraud Section)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

FCPA; Corporate Enforcement and Voluntary Self-Disclosure Policy (Declination)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Voluntary self-disclosure (including to the French national financial prosecutor's office, PNF), full cooperation, timely remediation, disciplinary measures, parallel resolution in France.

Liability of senior managers

Measures against individuals are not reported here.

Published

19 Mar 2026

Original amount 1,214,797 USD, converted at the ECB reference rate of 17 Mar 2026.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

Between January and June 2023, the Sarasota laboratory paid independent marketers to steer laboratory samples from Medicare beneficiaries to it. It self-disclosed the conduct, cooperated extensively and paid 980,000 USD.

Authority / court

U.S. Attorney's Office, Middle District of Florida

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Voluntary self-disclosure, detailed disclosure and cooperation.

Original amount 980,000 USD, converted at the ECB reference rate of 5 Mar 2026.

Checked against the official source on 25 Sep 2026 · Direct link

The clinic’s managing director himself reported that a former employee had copied contact details and patient records of all patients and poached them for a new clinic. In the subsequent investigation, the clinic did not fully answer the requests of the Romanian data protection authority (ANSPDCP) despite a reprimand and an order; the authority therefore imposed 10,190 lei (2,000 EUR). Date = publication of the press release; according to the authority, the investigation was concluded in February 2026.

Authority / court

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Feb 2026

Original amount 10,190 RON, converted at the ECB reference rate of 20 Feb 2026.

Checked against the official source on 25 Sep 2026 · Direct link

Following the tragedy at the Lapu-Lapu Day festival in 2025, 36 employees of three health authorities accessed patient data of 16 admitted persons without authorisation in 71 instances. Those affected were not informed without undue delay; the Information and Privacy Commissioner for British Columbia (OIPC BC) made nine recommendations, including automated access monitoring and deterrent disciplinary measures.

Authority / court

Office of the Information and Privacy Commissioner for British Columbia (OIPC BC)

Area of law

Data protection · Data breaches and data security

Legal basis

Freedom of Information and Protection of Privacy Act (FIPPA) BC, s. 25.1

Action

Other

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

Appropriate safeguards were in place; the authorities responded quickly and accepted all recommendations.

Published

18 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

The two companies colluded in tenders of the General Health Insurance Company for the supply of medicines (2017–2020). For the first time, a cartel was uncovered on the basis of information from a whistleblower; the Protimonopolný úrad Slovenskej republiky (Antimonopoly Office of the Slovak Republic, PMÚ SR) imposed 7,595,200 EUR and a one-year procurement ban on PHOENIX and 201,800 EUR and a three-year procurement ban on TRANSMEDIC (first instance).

Authority / court

Protimonopolný úrad Slovenskej republiky (PMÚ SR)

Area of law

Competition law · Cartels and collusion

Legal basis

Slowakisches Wettbewerbsschutzgesetz (Submissionsabsprache)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Mitigating circumstances

PHOENIX: settlement with a 30% fine reduction and a shortened procurement ban.

Published

24 Feb 2026

Checked against the official source on 25 Sep 2026 · Direct link

The hospital (until 2015 Hudson Valley Hospital Center) allegedly paid an oncology practice in Westchester millions of dollars to induce it to refer patients to the hospital; the hospital billed the services to Medicare and Medicaid. The U.S. Attorney’s Office filed a complaint and at the same time concluded a settlement of 6.8 million USD.

Authority / court

U.S. Attorney's Office, Southern District of New York

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 6,800,000 USD, converted at the ECB reference rate of 22 Dec 2025.

Checked against the official source on 25 Sep 2026 · Direct link

According to the FTC, the telemedicine company advertised GLP-1 weight-loss programmes with monthly prices that did not include medication, laboratory costs and medical consultations, concealed the minimum term and cancellation fees, published fake testimonials from employees and relatives, and induced customers to delete negative reviews by offering vouchers or refunds. Under the final settlement order, the company is paying 150,000 USD jointly with other liable parties (joint payment), which is earmarked for refunds.

Authority / court

Federal Trade Commission (FTC)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Section 5 FTC Act; Restore Online Shoppers' Confidence Act (ROSCA)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Published

3 Dec 2025

Original amount 150,000 USD, converted at the ECB reference rate of 3 Dec 2025.

Checked against the official source on 28 Sep 2026 · Version 3 · Direct link

A hospital of the group had removed from its archive earlier MRI scans that a patient had brought in for comparison once an internal collection period had expired, so that they were no longer available. The AEPD imposed 100,000 EUR each for processing health data without a legal basis (Art. 9 and Art. 6) and 1,000,000 EUR for lack of data protection by design in the procedure (Art. 25), 1,200,000 EUR in total.

Authority / court

Agencia Española de Protección de Datos (AEPD)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 6, 9, 25 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

20 Mar 2026

Checked against the official source on 28 Sep 2026 · Direct link

An assessment following several security compromises found that the laboratory company had notified neither the Information Regulator nor the affected data subjects. After an enforcement notice that it failed to comply with, it received an infringement notice with an administrative fine of ZAR 100,000, which has since been paid.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Data breaches and data security

Legal basis

Protection of Personal Information Act 4 of 2013 (POPIA), s. 22

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

13 Nov 2025

Original amount 100,000 ZAR, converted at the ECB reference rate of 13 Nov 2025.

Checked against the official source on 4 Oct 2026 · Direct link

Doctolib tied doctors with exclusivity clauses, bundled telemedicine with the appointment booking subscription and in 2018 acquired its main competitor in order to eliminate it (decision 25-D-06). Fines: 4.615 million EUR for exclusivity and tying, 50,000 EUR for the acquisition.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. 102 AEUV, Art. L.420-2 Code de commerce

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Culpability

intentional

Published

6 Nov 2025

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

Despite access requests, two patients did not receive copies of their scan files at the end of treatment; the practice responded only sluggishly to enquiries and did not attend an appointment with the supervisory authority. The Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate, AKI) ordered disclosure under Art. 15(3) GDPR or a reasoned refusal and threatened a penalty payment of 2,000 EUR.

Authority / court

Andmekaitse Inspektsioon (AKI)

Area of law

Data protection · Data subject rights and transparency

Legal basis

§ 56 Abs. 1 IKS; Art. 58 Abs. 2 lit. c, Art. 12 Abs. 4, Art. 15 DSGVO

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

On the application of the Australian Information Commissioner, the Federal Court of Australia imposed the first civil penalties under the Privacy Act 1988: Australian Clinical Labs (ACL) had failed to adequately protect the personal information held on the IT systems of its Medlab Pathology business; in a cyberattack in February 2022, data of more than 223,000 people was taken from those systems. The penalty of 5.8 million AUD in total comprises 4.2 million AUD for the inadequate security measures (APP 11.1), 800,000 AUD because ACL did not assess reasonably and promptly whether a notifiable data breach had occurred, and 800,000 AUD for the late notification to the Commissioner. ACL admitted the contraventions; liability and the penalty were allegedly based on joint submissions by the parties.

Authority / court

Office of the Australian Information Commissioner (OAIC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act 1988 (Cth) s 13G(a) i. V. m. APP 11.1; s 26WH(2); s 26WK(2)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

Cooperation with the investigation, an ongoing programme to uplift cyber security, apologies and admission of liability.

Liability of senior managers

The court found that the most senior management was involved in the decisions on integrating the Medlab systems and on assessing the attack.

Published

9 Oct 2025

Original amount 5,800,000 AUD, converted at the ECB reference rate of 8 Oct 2025.

Checked against the official source on 3 Oct 2026 · Direct link

For almost six years, the chair of the management board of the medical company was also its data protection officer; this came to light after a report that a patient had been handed documents relating to another person. Poland’s data protection authority (UODO) found a conflict of interest and imposed 11,365 PLN.

Authority / court

Prezes Urzędu Ochrony Danych Osobowych (UODO)

Area of law

Data protection

Legal basis

Art. 38 Abs. 6 DSGVO (DKN.5131.7.2025)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

An independent external data protection officer was appointed in July 2024.

Published

29 Sep 2025

Original amount 11,365 PLN, converted at the ECB reference rate of 12 Sep 2025.

Checked against the official source on 25 Sep 2026 · Direct link

A practice for aesthetic treatments advertised hyaluronic acid filler injections for the nose and chin on its website and on Instagram using before-and-after images. In an action brought by a consumer advice centre (Verbraucherzentrale), the BGH upheld the injunction issued by the Higher Regional Court of Hamm (OLG Hamm): such procedures are deemed to be surgical cosmetic procedures, for which this kind of advertising is prohibited.

Authority / court

Bundesgerichtshof (I. Zivilsenat), Az. I ZR 170/24

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

§ 11 Abs. 1 Satz 3 Nr. 1, § 1 Abs. 1 Nr. 2 Buchst. c HWG; UKlaG

Action

Order

Status of proceedings

final

Sector

Healthcare

Published

31 Jul 2025

Checked against the official source on 25 Sep 2026 · Direct link

The Minnesota provider of outpatient addiction treatment pays USD 18,500,000 to resolve False Claims Act allegations and entered into a five-year Corporate Integrity Agreement with HHS-OIG. According to the US Attorney's Office, from January 2019 to February 2025 NUWAY compensated Medicaid patients for attending intensive outpatient treatment and also billed services in which the same period of time was counted twice. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Attorney's Office, District of Minnesota (U.S. Department of Justice)

Area of law

Bribery and corruption · Gifts, hospitality and benefits

Legal basis

False Claims Act; Anti-Kickback Statute

Action

Other

Status of proceedings

final

Sector

Healthcare

Published

26 Jun 2025

Original amount 18,500,000 USD, converted at the ECB reference rate of 26 Jun 2025.

Checked against the official source on 3 Oct 2026 · Direct link

From April to September 2023, attackers used reused credentials to access data on 155,592 people in the United Kingdom, including ancestry, family trees and health information. There was no MFA, no secure password rules and no effective monitoring; despite anomalies in July 2023, the full investigation only began in October. Joint investigation by the UK Information Commissioner's Office (ICO) with the Privacy Commissioner of Canada.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

UK GDPR Art. 5 Abs. 1 lit. f, Art. 32 Abs. 1

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Employees

250 to 999

Culpability

negligent

Published

17 Jun 2025

Original amount 2,310,000 GBP, converted at the ECB reference rate of 5 Jun 2025.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

In 2018–2022, the online pharmacy transmitted purchase data, including data on prescription medicines, to the tracking providers via Google and Meta tracking. The sanctions board of the Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) imposed 1.1 million EUR and a reprimand; on 1 June 2026 the Helsingin hallinto-oikeus (Helsinki Administrative Court) upheld the infringement but annulled the fine because it was unclear whether a fine may be imposed on the university pharmacy at all (not final).

Authority / court

Tietosuojavaltuutetun toimisto – seuraamuskollegio; Helsingin hallinto-oikeus

Area of law

Data protection · Cookies and tracking

Legal basis

DSGVO Art. 9, Art. 25, Art. 32

Action

Fine

Status of proceedings

overturned

Sector

Healthcare

Published

4 Jun 2025

Amount in EUR; no ECB reference rate is available for this currency.

Checked against the official source on 25 Sep 2026 · Direct link

The CADE Tribunal convicted the federal council of physiotherapists and occupational therapists because, through resolutions, rulings and annually updated reference tables, it had set binding minimum prices for the services of members of the profession and thereby encouraged uniform market conduct. In addition to a fine of 3,103,583.65 BRL, COFFITO must refrain from binding price tables, remove all references to them from its websites (penalty of 5,000.00 BRL per day) and publish the decision on its website and social media; proceedings against the regional council for the 15th region are suspended owing to a settlement. The amount and the facts have not been confirmed against the primary source.

Authority / court

Conselho Administrativo de Defesa Econômica (CADE), Tribunal Administrativo

Area of law

Competition law · Cartels and collusion

Legal basis

Lei nº 12.529/2011; Art. 38 und 39 (Nebenanordnungen)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

10 Apr 2025

Original amount 3,103,583.65 BRL, converted at the ECB reference rate of 9 Apr 2025.

Checked against the official source on 3 Oct 2026 · Direct link

Despite being asked to do so, a healthcare provider (name redacted) did not correct a patient’s address, so that health reports were sent to third parties, and used address data from the electoral register without a legal basis. The Information and Data Protection Commissioner (IDPC) issued a reprimand, ordered rectification, erasure of the register data and the designation of a data protection officer, and imposed fines of 12,500, 5,000 and 2,500 EUR.

Authority / court

Information and Data Protection Commissioner (IDPC)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 5 Abs. 1 lit. a und d, Art. 6 Abs. 1, Art. 14, 16, 37 Abs. 1 lit. c DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 25 Sep 2026 · Direct link

The Markkinaoikeus (Market Court, Finland) imposed a penalty payment of 1,500,000 EUR on the care services provider Attendo Suomi Oy for obstructing an unannounced inspection by the competition authority in January 2023: after the inspection had begun, a manager deleted chat histories and the call log on a mobile phone also used for work. It was the first penalty for such a procedural infringement in Finland; the authority had sought 4,373,760 EUR, but the court gave considerably more weight to Attendo's own measures, including the swift restoration of the deleted chats.

Authority / court

Markkinaoikeus (Marktgericht) auf Antrag des Kilpailu- ja kuluttajavirasto (KKV)

Area of law

Competition law

Legal basis

Kilpailulaki (948/2011) 37 a § 1 mom. 1 kohta i. V. m. 35 § und 37 §

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Training and instructions for staff on conduct during inspections already before the incident; swift restoration and handover of the deleted chats from a backup; no advantage gained and no earlier penalties for procedural infringements.

Published

31 Mar 2025

Checked against the official source on 28 Sep 2026 · Direct link

Following a tip-off from the Military Medical Academy (VMA), the Комисия за защита на конкуренцията (Bulgarian Commission for the Protection of Competition, KZK) found that the centre presented its gynaecological practice as a VMA branch with signs reading ‘МЦ „ЛЮЛИН МЕД“ АГ – ВМА ФИЛИАЛ’ and corresponding online information. For misleading conduct (Art. 31 ZZK – Bulgarian Protection of Competition Act) it imposed 0.4% of 2023 turnover, i.e. 9,236 leva. An appeal has been lodged against the decision.

Authority / court

Комисия за защита на конкуренцията (КЗК, Bulgarische Wettbewerbskommission)

Area of law

Consumer protection and online retail · Misleading advertising and pricing

Legal basis

Art. 31 ZZK (Irreführung)

Action

Fine

Status of proceedings

under appeal

Sector

Healthcare

Original amount 9,236 BGN, converted at the ECB reference rate of 6 Feb 2025.

Checked against the official source on 25 Sep 2026 · Direct link

Bard and three affiliated companies pay USD 17 million to resolve allegations under the federal False Claims Act and several state statutes. Between 2016 and February 2020 they allegedly gave urology practices discounts, excessive free samples and savings on office supplies so that they would prescribe intermittent catheters by default using Bard's own “Link” prescription form; no liability was determined.

Authority / court

U.S. Attorney's Office, Northern District of Georgia (U.S. Department of Justice)

Area of law

Bribery and corruption · Gifts, hospitality and benefits

Legal basis

False Claims Act; Anti-Kickback Statute (42 U.S.C. § 1320a-7b); False-Claims-Gesetze mehrerer Bundesstaaten

Action

Other

Status of proceedings

final

Sector

Healthcare

Published

23 Jan 2025

Original amount 17,000,000 USD, converted at the ECB reference rate of 23 Jan 2025.

Checked against the official source on 3 Oct 2026 · Direct link

The Controladoria-Geral da União (CGU, Office of the Comptroller General) imposed on the Associação da Irmandade da Santa Casa de Misericórdia de Pacaembu, an association operating as a healthcare social organisation (Organização Social), a fine of BRL 47,391,386.87, extraordinary publication of the decision and a declaration of unsuitability for public contracts. According to the final report, the association rigged the selection procedure for managing the Hangar field hospital in Belém (Pará), committed fraud in performing the management contract for a regional hospital in Belém and used front persons and companies to conceal its real interests.

Authority / court

Controladoria-Geral da União (CGU)

Area of law

Bribery and corruption

Legal basis

Lei nº 12.846/2013, Art. 5 III und IV b und d, Art. 6, Art. 14; Lei nº 8.666/1993, Art. 87 IV und Art. 88 II und III

Action

Fine

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not set out here.

Published

28 Jan 2025

Original amount 47,391,386.87 BRL, converted at the ECB reference rate of 23 Jan 2025.

Checked against the official source on 3 Oct 2026 · Direct link

Following a ransomware attack in 2021 – the second after an attack in 2019 – the Litigation Chamber found that a Belgian hospital had, among other things, no data protection impact assessment, no effective information security policy, no adequate procedure for security updates of its software and no genuine training and awareness programme for staff. On 17 December 2024 it imposed a fine of 200,000 EUR, ordered remedial measures and rejected the argument that, as a public body, the hospital could not be fined. On 3 September 2025 the Market Court partially annulled the decision and reduced the fine to 50,000 EUR; the data protection authority has lodged an appeal in cassation against that judgment. The decision is not final. The amount and the facts have not been confirmed against the primary source.

Authority / court

Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA) – Chambre Contentieuse

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. f, Art. 24, Art. 32 und Art. 35 Abs. 3 DSGVO; Art. 58 Abs. 2 lit. d und i sowie Art. 83 DSGVO; Art. 100 § 1 9° und 13° sowie Art. 101 LCA

Action

Fine

Status of proceedings

reduced

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The Chamber reduced the starting amount of 390,000 EUR to 200,000 EUR, mainly because of the hospital's financial difficulties, the Covid-19 crisis as a mitigating circumstance and a reassessed duration of the infringement.

Checked against the official source on 7 Oct 2026 · Version 2 · Direct link

The medical technology manufacturer misled investors about regulatory risks of the Alaris infusion pump, which had more than 25 software defects, and did not record the remediation costs, as a result of which operating income in the fourth quarter of 2019 was overstated by 82 %. BD is paying 175 million USD and must appoint an independent compliance consultant.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Capital markets and financial supervision · Disclosure and reporting obligations

Legal basis

Antifraud-, Reporting-, Buchführungs-, interne Kontroll- und Disclosure-Controls-Vorschriften der US-Wertpapiergesetze

Action

Fine

Status of proceedings

final

Sector

Healthcare

Original amount 175,000,000 USD, converted at the ECB reference rate of 16 Dec 2024.

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The ICO issued a reprimand to United Lincolnshire Teaching Hospitals NHS Trust. The ICO found that between March 2021 and March 2022 the trust failed to answer 32% of subject access requests within the one-month statutory deadline. The ICO found infringements of the requirements to respond on time.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Employees

1,000 to 9,999

Checked against the official source on 28 Sep 2026 · Version 2 · Direct link

The Californian hospital pays USD 10,250,000 (USD 9,518,954 to the federal government, USD 731,046 to the State of California) and entered into a five-year Corporate Integrity Agreement with HHS-OIG. The allegations were that it paid doctors who decided on inpatient admissions bonuses based on the number of patients admitted, billed medically unnecessary inpatient admissions and used false diagnosis codes for SIRS. The authority allegedly made the findings set out here; this account is not based on a final judgment.

Authority / court

U.S. Attorney's Office, Eastern District of California (U.S. Department of Justice)

Area of law

Bribery and corruption · Commercial bribery

Legal basis

False Claims Act; Anti-Kickback Statute

Action

Other

Status of proceedings

final

Sector

Healthcare

Published

12 Dec 2024

Original amount 10,250,000 USD, converted at the ECB reference rate of 12 Dec 2024.

Checked against the official source on 3 Oct 2026 · Direct link

A limited company operating a diagnostic laboratory (name pseudonymised), which during the pandemic carried out up to 45,000 PCR analyses a day with around 200 employees, had appointed its managing director as data protection officer at the same time. Because of the resulting conflict of interest, the Austrian data protection authority (Datenschutzbehörde, DSB) imposed 5,000 EUR; the penalty decision is final.

Authority / court

Datenschutzbehörde (DSB)

Area of law

Data protection

Legal basis

Art. 37, Art. 38 Abs. 6 DSGVO

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

50 to 249

Liability of senior managers

The managing director was also appointed as data protection officer – an impermissible conflict of interest.

Checked against the official source on 25 Sep 2026 · Direct link

A Danish non-profit health organisation reported thefts of computers from its offices as well as phishing attacks in 2019 and 2020; according to the Danish Data Protection Agency (Datatilsynet), at least 1,448 people were affected, some with health data. Although the organisation itself had considered multi-factor authentication necessary after an attack in 2018, this and encryption of the computers were lacking. A Danish city court issued a final judgment ordering it to pay 75,000 DKK (Datatilsynet's recommendation and the prosecution's request: 800,000 DKK).

Authority / court

Københavns Byret (auf Anzeige der Datatilsynet)

Area of law

Data protection · Data breaches and data security

Legal basis

DSGVO Art. 32 Abs. 1; databeskyttelsesloven § 41

Action

Fine

Status of proceedings

final

Sector

Healthcare

Repeat case

yes

Original amount 75,000 DKK, converted at the ECB reference rate of 1 Oct 2024.

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 1 Oct 2026 · Direct link

At one of the provider's care facilities, part of a resident's paper file was lost, which came to light during a special audit in August 2021. Although staff considered the incident notifiable and the health board and later the Health and Disability Commissioner (health complaints authority) urged notification, the company only informed the Office of the Privacy Commissioner (OPC, New Zealand's data protection authority) in October 2023. On 24 September 2024 the Privacy Commissioner found a breach of the notification duty and poor document management and named the company publicly.

Authority / court

Office of the Privacy Commissioner (OPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Privacy Act 2020, s 114

Action

Other

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Constructive engagement; introduction of an electronic document management system with access controls, staff training, a privacy breach management plan and a revised management structure.

Published

24 Sep 2024

Checked against the official source on 7 Oct 2026 · Company name anonymised since 24 Sep 2026 · Direct link

The Datu valsts inspekcija (Latvian Data State Inspectorate, DVI) examined several complaints against the state hospital, including about the processing of patient and health data by a physician assistant and about an unanswered access request. Because the hospital did not provide the requested information, the authority imposed 2,000 EUR for breach of the duty to cooperate.

Authority / court

Datu valsts inspekcija (DVI)

Area of law

Data protection

Legal basis

Art. 58 Abs. 1, Art. 83 Abs. 5 lit. e DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

intentional

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Sep 2026 · Direct link

In 2019, a specialist hospital in the Rijeka area (name not published) irretrievably lost patients’ radiological images because it did not make backup copies, and did not report the incident although management had been informed. The Agencija za zaštitu osobnih podataka (Croatian Personal Data Protection Agency, AZOP) imposed 190,000 EUR, including for a missing data processing agreement, call recordings without a legal basis and failure to involve the data protection officer.

Authority / court

Agencija za zaštitu osobnih podataka (AZOP)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. e, Art. 6, 12, 13, 28 Abs. 3, 32 Abs. 1 lit. b, 33 Abs. 1, 38 Abs. 1 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

13 Sep 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 13 Sep 2026 · Direct link

Between July 2019 and July 2023, the healthcare company had employees waive potential awards for reports to authorities in 98 employment, separation, retention and settlement agreements; in 56 further separation and settlement agreements, they had to waive complaints to federal authorities. As part of a sweep against seven listed companies, the company paid 1,386,000 US dollars to the U.S. Securities and Exchange Commission (SEC); the contract templates were amended.

Authority / court

U.S. Securities and Exchange Commission

Area of law

Whistleblower protection · Retaliation against whistleblowers

Legal basis

Securities Exchange Act of 1934, Rule 21F-17(a)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Partial amendment of the templates even before contact by the SEC, information provided to those affected, and cooperation

Published

9 Sep 2024

Original amount 1,386,000 USD, converted at the ECB reference rate of 9 Sep 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 Sep 2026 · Direct link

The CNIL (French data protection authority) fined a French medical software provider EUR 800,000 because patient data were processed via its practice software for a health database without the authorisation required by Art. 66 of the Loi Informatique et Libertés (French Data Protection Act), and because data were also collected from the health insurance teleservice HRi, which only doctors may access (Art. 5(1)(a) GDPR). On 13 February 2026 the Conseil d'État (French supreme administrative court) dismissed the company's appeal and confirmed that the pseudonymised data are personal data because of the risk of re-identification.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés); Art. 5 Abs. 1 lit. a DSGVO

Action

Fine

Status of proceedings

final

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The company filed the required authorisation applications during the proceedings; no order was therefore issued.

Published

12 Sep 2024

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 5 Sep 2026 · Direct link

The Integritetsskyddsmyndigheten (IMY, Swedish data protection authority) fined the pharmacy chain 37,000,000 SEK because, between 19 January 2020 and 25 April 2022, the company had not taken appropriate technical and organisational measures when using the Meta Pixel analytics tool on its website. Through the activated advanced matching function, contact details including personal identity numbers in hashed form, together with details of purchased, partly sensitive products, reached Meta when purchases were made; according to the incident report, an estimated 500,001 to 1,000,000 people were affected. The pharmacy chain learned of this through a tip-off from an outside party; the fine was based on its 2023 annual turnover of 23.27 billion SEK.

Authority / court

Integritetsskyddsmyndigheten (IMY)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 32 Abs. 1 DSGVO; Art. 58 Abs. 2 und Art. 83 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

In assessing seriousness, IMY took into account that the data went in hashed form to a single recipient and that security measures were already in place; it treated notification, cooperation and subsequent remediation as neutral.

Original amount 37,000,000 SEK, converted at the ECB reference rate of 29 Aug 2024.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 29 Aug 2026 · Direct link

The CNIL (French data protection authority) fined a statistics company belonging to a French corporate group EUR 800,000 because it operated two databases containing health data from medical practices and from pharmacies without the authorisation required by Art. 66 of the Loi Informatique et Libertés (French Data Protection Act); at the end of March 2021 they held data on 13.4 million medical consultations with 4 million patient codes and around 78 million identifiers respectively. On 13 February 2026 the Conseil d'État (French supreme administrative court) dismissed the appeal, holding that the data were only pseudonymised and therefore personal data.

Authority / court

Commission nationale de l'informatique et des libertés (CNIL), formation restreinte

Area of law

Data protection

Legal basis

Art. 66 Loi n° 78-17 du 6 janvier 1978 (Loi Informatique et Libertés)

Action

Fine

Status of proceedings

final

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

The company filed the required authorisation applications during the proceedings; no order was therefore issued.

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 28 Aug 2026 · Direct link

The Texas Attorney General's office concluded an Assurance of Voluntary Compliance with a Texas-based provider of generative AI for hospitals and submitted it to the court for approval. The provider had advertised the accuracy of its software, which summarises patient data for hospital staff, including with a 'severe hallucination' rate of less than 1 in 100,000; the authority considered these metrics likely to be inaccurate and misleading. For five years the provider must clearly explain such metrics in its advertising or have them substantiated by an independent auditor, and must disclose to its customers the risks, limitations and appropriate use of its products; the company denies any wrongdoing, and no payment is provided for.

Authority / court

Office of the Attorney General of Texas, Consumer Protection Division

Area of law

AI and digital regulation · AI systems

Legal basis

Texas Deceptive Trade Practices–Consumer Protection Act (DTPA), Tex. Bus. & Com. Code §§ 17.41–17.63; Zusicherung nach § 17.58

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

18 Sep 2024

Checked against the official source on 8 Oct 2026 · Company name anonymised since 21 Aug 2026 · Direct link

The dialysis group allegedly paid kickbacks to promote referrals to its former pharmacy subsidiary and granted benefits to nephrologists and vascular surgeons to induce them to send patients to the group's dialysis centres. The group paid 34,487,390 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Employees

10,000 or more

Original amount 34,487,390 USD, converted at the ECB reference rate of 18 Jul 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 18 Jul 2026 · Direct link

Three home health agencies in Texas, Ohio and Indiana and their parent company allegedly granted kickbacks to assisted living facilities and physicians for Medicare referrals. They paid 4,496,330 USD.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 4,496,330 USD, converted at the ECB reference rate of 1 Jul 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 1 Jul 2026 · Direct link

At the care facility, employees worked up to 24 hours a day, seven days a week, were not allowed to leave the premises, had to work through breaks and received no overtime pay. The settlement of 658,948 USD comprises 608,948 USD for 34 employees (including overtime and break premiums) and 50,000 USD in civil penalties.

Authority / court

California Labor Commissioner's Office (Division of Labor Standards Enforcement)

Area of law

Health and safety and employment law · Working time

Legal basis

California Labor Code (Überstunden, Meal and Rest Periods, Mindestlohn)

Action

Other

Status of proceedings

final

Sector

Healthcare

Original amount 658,948 USD, converted at the ECB reference rate of 12 Jun 2024.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 12 Jun 2026 · Direct link

The medical corporation promised people attending an internal medicine clinic it operates for a flu vaccination a reduction in the vaccination fee if they rated the clinic with five or four stars on Google Maps. Consumers could not recognise the resulting reviews as advertising prompted by the provider; the order required it to stop displaying them, inform consumers and take preventive measures that also cover the medical staff.

Authority / court

Consumer Affairs Agency (消費者庁, CAA)

Area of law

Consumer protection and online retail · Fake reviews

Legal basis

Art. 7 Abs. 1 i. V. m. Art. 5 Nr. 3 (Bekanntmachung zu Stealth-Marketing) Act against Unjustifiable Premiums and Misleading Representations (不当景品類及び不当表示防止法, Gesetz Nr. 134/1962)

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

7 Jun 2024

Checked against the official source on 8 Oct 2026 · Company name anonymised since 6 Jun 2026 · Direct link

The Utah manufacturer of spinal implants allegedly paid surgeons kickbacks to induce them to use the manufacturer's products. The settlement of 12 million USD is a joint payment by the company and other settling parties; HHS-OIG placed the company under heightened scrutiny.

Authority / court

U.S. Department of Justice

Area of law

Bribery and corruption · Commercial bribery

Legal basis

Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)); False Claims Act (31 U.S.C. §§ 3729 ff.)

Action

Other

Status of proceedings

final

Sector

Healthcare

Liability of senior managers

Measures against individuals are not reported here.

Original amount 12,000,000 USD, converted at the ECB reference rate of 29 May 2024.

Checked against the official source on 28 Sep 2026 · Version 6 · Company name anonymised since 29 May 2026 · Direct link

The ICO issued a reprimand to an English NHS university hospital trust. According to the ICO's findings, the hospital answered only 59% of subject access requests on time between 1 August 2022 and 1 July 2023, and 621 requests were still outstanding on 30 January 2024. Until January 2021 requests had been handled in alphabetical order, and the trust extended deadlines across the board without telling the people concerned. The ICO found infringements of Articles 12(3), 15(1) and 15(3) UK GDPR. The date follows from the six-month deadline to 25 September 2024 set in the reprimand and matches the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data subject rights and transparency

Legal basis

Art. 12(3), 15(1) und 15(3) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 25 Mar 2026 · Direct link

The medical technology company sent service e-mails about an app for diabetes patients in such a way that the addresses of hundreds of recipients were visible to everyone, because they were placed in the open address field instead of blind copy; health data thereby reached unauthorised persons. In addition, the privacy information for patients did not state the legal basis for passing data to healthcare professionals. The Garante (Italian data protection authority) imposed fines totalling 300,000 EUR: 250,000 EUR for the data breach and 50,000 EUR for the incomplete information.

Authority / court

Garante per la protezione dei dati personali

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5 Abs. 1 lit. a und f, 9, 12, 13 und 32 DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

Mitigating: no complaints, revised procedures, supplemented privacy information and a high level of cooperation; the infringements were considered unintentional.

Published

7 Mar 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 8 Feb 2026 · Direct link

The Controladoria-Geral da União (CGU, Office of the Comptroller General) imposed on a healthcare services company a fine of BRL 21,697,740.49, extraordinary publication of the decision and a declaration of unsuitability for public contracts. According to the final report, in Ministry of Health tenders for medicines for rare diseases (Aldurazyme, Myozyme, Fabrazyme) the company had submitted bids without being authorised to market these products, failed to deliver the agreed quantities on time and appropriated advance payments to the detriment of the Treasury. The CGU rejected its request for reconsideration on 15 June 2025.

Authority / court

Controladoria-Geral da União (CGU)

Area of law

Bribery and corruption

Legal basis

Lei nº 12.846/2013, Art. 5 IV b und d, Art. 6; Lei nº 8.666/1993, Art. 87 IV und Art. 88 II und III

Action

Fine

Status of proceedings

final

Sector

Healthcare

Published

12 Jan 2024

Original amount 21,697,740.49 BRL, converted at the ECB reference rate of 9 Jan 2024.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 9 Jan 2026 · Direct link

The hospital trust was fined £480,000 and ordered to pay £4,286.15 in costs after an employee was found unconscious in a manhole on 1 February 2022 while unblocking a drain and suffered a brain injury. The Health and Safety Executive found that the manhole had not been identified as a confined space and the task had not been properly risk-assessed; there was no safe system of work for clearing blocked drains, and the estates team had not been trained for work in confined spaces.

Authority / court

Wellingborough Magistrates' Court (Anklage: Health and Safety Executive)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 2(1) Health and Safety at Work etc. Act 1974

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Guilty plea.

Published

9 Jan 2024

Original amount 480,000 GBP, converted at the ECB reference rate of 9 Jan 2024.

Checked against the official source on 3 Oct 2026 · Company name anonymised since 9 Jan 2026 · Direct link

Since 2015, the chamber’s professional code had prohibited its members from offering services below list price, at a discount or free of charge and from advertising prices and promotions – including online. As the first decision under the new act and in the first settlement procedure, the Javna agencija Republike Slovenije za varstvo konkurence (Slovenian Competition Protection Agency, AVK) imposed 43,000 EUR.

Authority / court

Javna agencija Republike Slovenije za varstvo konkurence (AVK)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 5 ZPOmK-2, Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Settlement with acknowledgement of responsibility.

Published

22 Jan 2024

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Dec 2025 · Direct link

The ICO issued a reprimand to an English NHS hospital trust. According to the ICO's findings, a hospital administrator sent an appointment letter for a child's medical examination to the wrong address, the home of the mother's relatives rather than the father's, together with an advice leaflet, causing significant distress to the family. The ICO criticised the trust for being unable to show a documented process or adequate guidance for handling particularly sensitive correspondence received through unusual channels. It found infringements of Articles 5(1)(f) and 5(1)(d) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 5(1)(d) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 20 Dec 2025 · Direct link

The healthcare products company implemented a concentration that was subject to notification because of the market share threshold, without prior notification and clearance by the competition authority; notification was only made afterwards. In settlement proceedings with a confession and full cooperation, the AdC (Autoridade da Concorrência, the Portuguese Competition Authority) imposed a fine of 75,000 EUR – the first whose proceeds go entirely to the state, specifically to the new Fund for the Promotion of Consumer Rights.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Merger control

Legal basis

Lei da Concorrência, Art. 37 Abs. 1 lit. a (Anmeldepflicht nach Marktanteilsschwelle) und Vollzugsverbot vor Freigabe

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Full cooperation, subsequent notification, settlement proceedings with confession.

Published

20 Dec 2023

Checked against the official source on 28 Sep 2026 · Version 3 · Company name anonymised since 19 Dec 2025 · Direct link

In its final decision in the teleradiology cartel (five addressees) the competition authority imposed fines of 1,648,800 EUR: 1,139,200 EUR, 503,600 EUR and 6,000 EUR on the three condemned companies. It also excluded the three condemned companies from public teleradiology tenders for one year; two other cartel members had already been sanctioned by settlement in 2022 (total for the proceedings 6,889,300 EUR).

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 9 Lei n.º 19/2012 (Lei da Concorrência); Art. 101 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

15 Jan 2024

Checked against the official source on 28 Sep 2026 · Company name anonymised since 18 Dec 2025 · Direct link

Between October 2017 and May 2019 the health products company listed on Euronext Growth published false or misleading information in twelve press releases and in its 2017 annual financial report, including 2017 revenue increased by unsubstantiated orders from a customer (10.5 instead of 9.74 million EUR) and overly positive statements on the roll-out of its own telemedicine station and on draw-downs under convertible bond financing. The Commission des sanctions of the AMF (Autorité des marchés financiers, French financial markets authority) imposed EUR 200,000 on the company and EUR 100,000 on the financier, which had failed to notify and publish net short positions in the company's shares. The amount covers only the sanctions imposed on the two companies. Whether they are final has not been verified here.

Authority / court

Autorité des marchés financiers (AMF), Commission des sanctions

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Art. 12 Abs. 1 lit. c, Art. 12 Abs. 4 und Art. 15 MAR; Art. 5 und 6 Verordnung (EU) Nr. 236/2012 (Leerverkäufe) und Art. 223-37 RG AMF (Negma)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

The company cooperated and, after a change of management, introduced remedial measures (independent board members, separation of chair and chief executive, multi-step sign-off of press releases, an insider tool); the Commission did not assess their effectiveness.

Published

29 Nov 2023

Checked against the official source on 2 Oct 2026 · Company name anonymised since 27 Nov 2025 · Direct link

The ICO issued a reprimand to a Scottish regional health board. According to the ICO's findings, an unauthorised individual got onto a hospital ward and, because there were no identity checks and the process was unclear, was handed a handover document containing personal and health data of 14 patients and helped to care for one patient; the document was taken away and has not been recovered. The ICO also criticised the absence of any procedure for recording whether such documents were destroyed at the end of a shift, and an overall training rate of 42%. It found an infringement of Article 5(1)(f) UK GDPR; its reasoning also refers to Article 32(2) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR (in der Begründung zusätzlich Art. 32(2) UK GDPR); Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 23 Nov 2025 · Direct link

The operator of a hospital in Roehampton was fined £140,000, with costs to be decided later. In 2013 a young patient on a specialist psychiatric ward was found unconscious in a lounge and died three days later. The Health and Safety Executive found that the company had not organised in-patient treatment so that patients were not exposed to risks to their health.

Authority / court

Southwark Crown Court (Anklage: Health and Safety Executive)

Area of law

Health and safety and employment law · Workplace safety and accidents

Legal basis

Section 3(1) Health and Safety at Work etc. Act 1974

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Guilty plea.

Published

14 Nov 2023

Original amount 140,000 GBP, converted at the ECB reference rate of 14 Nov 2023.

Checked against the official source on 3 Oct 2026 · Company name anonymised since 14 Nov 2025 · Direct link

The ICO issued a reprimand to an English NHS university hospital trust. According to the ICO's findings, outpatient referrals dropped off the worklist of the electronic referral system after 180 days and were lost to the hospital after more than 550 days; the trust had set up neither a formal process nor training for the manual follow-up. A total of 4,768 people were affected: 4,199 had their referrals delayed and for 569 the data disappeared from the system; some waited more than two years for treatment. The ICO found an infringement of Article 5(1)(f) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Oct 2025 · Direct link

In April and May 2022, unauthorised parties used a brute-force attack at a service provider to access some 3.6 million records (names, email addresses, mobile numbers) from the pharmacy chain's e-statement service; the regulator found weak passwords, inadequate monitoring, no written contract with the operator and a failure to notify the data subjects. By enforcement notice of 31 August 2023 it ordered, among other things, a personal information impact assessment, an incident response plan, PCI DSS measures and written contracts with all operators; in March 2024 it confirmed compliance and closed the file.

Authority / court

Information Regulator (South Africa)

Area of law

Data protection · Data breaches and data security

Legal basis

Sections 19(1)(b), 19(2), 19(3), 21(1) und 22(1)(b) Protection of Personal Information Act 4 of 2013 (POPIA); Enforcement Notice nach Section 95 POPIA

Action

Order

Status of proceedings

final

Sector

Healthcare

Published

1 Sep 2023

Checked against the official source on 8 Oct 2026 · Company name anonymised since 31 Aug 2025 · Direct link

The healthcare group kept two sets of accounting records and, between March 2019 and February 2020, published misleading financial information that understated its debt by around 4 billion USD. The FCA issued a public censure and refrained from imposing a fine so as not to reduce the amounts available to creditors.

Authority / court

Financial Conduct Authority (FCA)

Area of law

Capital markets and financial supervision · Market abuse and insider dealing

Legal basis

Art. 15 i. V. m. Art. 12 Abs. 1 lit. c MAR; s. 123(3) FSMA 2000 (öffentliche Rüge)

Action

Reprimand or warning

Status of proceedings

final

Sector

Healthcare

Published

17 Nov 2023

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 30 Aug 2025 · Direct link

From 2014 to 2018, employees of the group's Chinese subsidiary invited healthcare officials of state-owned customers abroad to purported conferences and training courses that in reality often consisted of sightseeing and entertainment; payment was made via a complicit travel agency. Payment of 3,538,897 USD in disgorgement, 1,042,721 USD in interest and a penalty of 2 million USD.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Bribery and corruption · Gifts, hospitality and benefits

Legal basis

FCPA Buchführungs- und interne Kontrollvorschriften

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

10,000 or more

Culpability

intentional

Mitigating circumstances

Prompt self-report upon becoming aware, cooperation (including witnesses and documents) and extensive remedial measures.

Published

25 Aug 2023

Original amount 6,581,618 USD, converted at the ECB reference rate of 25 Aug 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 25 Aug 2025 · Direct link

The Tribunal of the Conselho Administrativo de Defesa Econômica (CADE, Brazilian competition authority) unanimously fined the federal council of dentists 752,700 BRL because its rules (Resolution No. 118/2012) prohibited dentists from granting discounts and accepting discount cards. The council must amend the resolution within 180 days, close disciplinary proceedings based on it within 90 days and publish the decision on its website for 90 days; non-compliance carries a penalty of 10,000 BRL per day and per breach. The proceedings against a regional council were suspended because of a settlement (TCC).

Authority / court

Conselho Administrativo de Defesa Econômica (CADE), Tribunal Administrativo

Area of law

Competition law · Cartels and collusion

Legal basis

Lei nº 12.529/2011 (Lei de Defesa da Concorrência), Nebenanordnungen nach Art. 38 und 39

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Published

16 Aug 2023

Original amount 752,700 BRL, converted at the ECB reference rate of 16 Aug 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 16 Aug 2025 · Direct link

The ICO issued a reprimand to a Scottish regional health board. According to the ICO's findings, between 1 April 2020 and 25 April 2022 staff in one team shared patient data in an unapproved messaging app group with 26 members, including at least 533 entries with names of adults and children, phone numbers, dates of birth, addresses and images containing clinical information; in addition, an unauthorised person was added to the group by mistake. The group was used during the Covid-19 pandemic as a substitute for conversations in the office, without the organisation's knowledge. The ICO found infringements of Articles 5(1)(f), 25(1) and 32(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 25(1) und 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 31 Jul 2025 · Direct link

The ICO issued a reprimand to a patient advocacy body in Northern Ireland. According to the ICO's findings, on 20 January 2021 a member of staff sent an email to the 15 members of an advisory panel being set up for people with lived experience of gender dysphoria and mistakenly put the recipients in CC rather than BCC; 13 of the addresses identified the individual, so health data was disclosed. The ICO considered email using BCC unsuitable given the sensitivity and criticised the lack of guidance on using BCC and an out-of-date email policy. It found infringements of Articles 5(1)(f) and 32(1) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 32(1) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 19 Jul 2025 · Direct link

The FTC finalised its order against an online therapy provider. According to the authority, despite promises of confidentiality the company passed e-mail addresses, IP addresses and answers from its health questionnaire to three social networks and an advertising technology company for advertising purposes without obtaining affirmative consent. The provider pays 7,800,000 USD for partial refunds to customers, may no longer share health data for advertising, must obtain affirmative consent before sharing with certain third parties, must instruct the recipients to delete the data and must set retention periods.

Authority / court

Federal Trade Commission (FTC)

Area of law

Data protection · Marketing and consent

Legal basis

Section 5(a) FTC Act, 15 U.S.C. § 45(a) (unlautere und irreführende Praktiken)

Action

Disgorgement of profits

Status of proceedings

final

Sector

Healthcare

Published

14 Jul 2023

Original amount 7,800,000 USD, converted at the ECB reference rate of 7 Jul 2023.

Checked against the official source on 8 Oct 2026 · Company name anonymised since 7 Jul 2025 · Direct link

From 2014 to 2019, employees, distributors and sub-distributors of the group's Chinese subsidiary improperly influenced the technical specifications of public hospital tenders and organised sham bids with products from other manufacturers; special discounts to distributors also created the risk that inflated margins financed payments to employees of state-owned hospitals. Payment of 41,126,170 USD in disgorgement, 6,047,633 USD in interest and a penalty of 15 million USD; the group had already been sanctioned in 2013 for similar conduct in Poland.

Authority / court

U.S. Securities and Exchange Commission (SEC)

Area of law

Bribery and corruption · Bribery of public officials

Legal basis

FCPA Buchführungs- und interne Kontrollvorschriften

Action

Fine

Status of proceedings

final

Sector

Healthcare

Employees

10,000 or more

Culpability

intentional

Repeat case

yes

Published

11 May 2023

Original amount 62,173,803 USD, converted at the ECB reference rate of 11 May 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 11 May 2025 · Direct link

The ICO issued a reprimand to an English NHS university hospital trust. According to the ICO's findings, the trust routinely listed the full postal addresses of other recipients as copy recipients on letters, without seeking their consent or assessing the risk; as a result, one person's address was disclosed to their former partner despite previous allegations of abuse. The ICO also criticised the lack of a process to flag such situations in parental disputes and the lack of training for administrative staff. It found an infringement of Article 5(1)(f) UK GDPR. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 25 Apr 2025 · Direct link

The healthcare provider had outsourced call centre and appointment booking services to a social enterprise, which copied customer data for its call centre agents onto an internet-facing file server whose password protection had been disabled for around 20 months; in 2021 data on numerous customers (including diagnosis codes and bank details) was accessed without authorisation and offered for sale on the dark web. The Personal Data Protection Commission (PDPC, Singapore's data protection authority) found shortcomings in security reviews and password management at the data intermediary, the social enterprise, and at the healthcare provider inadequate ongoing oversight of the service provider and unnecessary disclosure of sensitive financial and health data. It imposed 68,000 SGD on the two together and directed both to review contracts, data sharing and the scope of security reviews.

Authority / court

Personal Data Protection Commission (PDPC)

Area of law

Data protection · Data processors

Legal basis

Section 24 PDPA 2012 (Protection Obligation) i. V. m. Sections 4(2) und 4(3) PDPA (Data Intermediary); Section 48J PDPA (Financial Penalty); Section 48I PDPA (Directions)

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Both cooperated, admitted the breaches under the Expedited Decision Procedure and remedied promptly; in setting the amounts, the healthcare provider's turnover of around 50 times that of the social enterprise was taken into account.

Published

22 Jun 2023

Original amount 68,000 SGD, converted at the ECB reference rate of 23 Mar 2023.

Checked against the official source on 7 Oct 2026 · Company name anonymised since 23 Mar 2025 · Direct link

The ICO issued a reprimand to a Scottish regional health board. According to the ICO's findings, on 13 June 2019 an invitation was emailed to 37 people without using the BCC function, so all recipients could see the other addresses, most of which contained names; because the recipients were identifiable as likely users of HIV services, the ICO considered the addresses likely to be health data. One recipient recognised at least four other people. The ICO considered that relying on BCC for this group was not the most secure approach and found infringements of Articles 5(1)(f), 32(1) and 25 UK GDPR. According to the reprimand, the ICO had considered a fine of GBP 35,000 but did not impose one because of its revised approach to the public sector since June 2022. The reprimand is undated; the date follows the ICO case page.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 32(1) und 25 UK GDPR; Verwarnung nach Art. 58(2)(b) UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 9 Mar 2025 · Direct link

Datatilsynet (Norwegian Data Protection Authority) fined a US medical device manufacturer NOK 2,500,000 because it notified a cyber incident affecting the data of all its European employees (including one person in Norway) only 67 days after becoming aware of it instead of within 72 hours (Art. 33(1) GDPR). Under its internal rules, the manufacturer intended to notify only once the incident had been fully investigated. Following the company's appeal, the fine was reduced to NOK 1,500,000 because of the long case-handling time before the matter was dealt with by the Personvernnemnda (Privacy Appeals Board); the Personvernnemnda upheld the decision at that amount.

Authority / court

Datatilsynet

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 33 Abs. 1, Art. 58 Abs. 2 lit. i, Art. 83 Abs. 4 lit. a DSGVO

Action

Fine

Status of proceedings

reduced

Sector

Healthcare

Culpability

negligent

Mitigating circumstances

Reduction to NOK 1,500,000 because of the long case-handling time before the matter was dealt with by the Personvernnemnda.

Published

16 Mar 2023

Original amount 1,500,000 NOK, converted at the ECB reference rate of 8 Mar 2023.

Checked against the official source on 28 Sep 2026 · Company name anonymised since 8 Mar 2025 · Direct link

On 7 March 2023 the ICO issued a reprimand to an English NHS hospital trust. According to the ICO's findings, before the licence for an electronic document viewing system expired, the trust downloaded the patient records it held but did not check that the download was incomplete; data of 1,159 people was affected: records of 1,155 people were inaccessible from 19 January 2020 until 12 October 2021, and parts of the records of four patients were permanently lost. There was no decommissioning policy and no adequate oversight; one patient's care planning was affected. The ICO found infringements of Articles 5(1)(f), 24(1) and 24(2) UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 24(1) und 24(2) UK GDPR; Verwarnung nach Art. 58 UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 7 Mar 2025 · Direct link

A ransomware attack on the patient administration system, notified in December 2019, affected around 70,000 people; for 2,500 patients the data were permanently lost because no backup existed. The DPC found infringements of Art. 5(1)(f), 5(2) and 32(1) GDPR, issued a reprimand and imposed three fines of €275,000, €50,000 and €135,000, totalling €460,000.

Authority / court

Data Protection Commission (DPC)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f), 5(2), 32(1) DSGVO

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 2 Oct 2026 · Company name anonymised since 23 Feb 2025 · Direct link

For years, the telehealth and discount platform passed its users’ health data to three large advertising and technology companies and other advertising partners and did not notify these unauthorised disclosures as required by the Health Breach Notification Rule. In the first proceedings under this rule, the platform agreed to a civil penalty of 1.5 million USD and a ban on sharing for advertising purposes; the settlement was still subject to court approval.

Authority / court

Federal Trade Commission (FTC) / U.S. Department of Justice

Area of law

Information security and cyber · Incident reporting obligations

Legal basis

FTC Health Breach Notification Rule (16 CFR Part 318); Section 5 FTC Act

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Original amount 1,500,000 USD, converted at the ECB reference rate of 1 Feb 2023.

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 1 Feb 2025 · Direct link

In an investigation report published on 14 November 2022, the Privacy Commissioner for Personal Data (PCPD, Hong Kong's data protection authority) found that the listed healthcare group, after acquiring two brands, had moved their clients' data into a group-wide system and made it accessible to staff of other brands; in the two underlying complaint cases the individuals concerned had neither been informed nor given their consent. The system was used by 28 of the group's 39 brands and held data on around 1.08 million members; the PCPD found a breach of the purpose limitation rule in DPP 3(1). By enforcement notice, the group must stop cross-brand sharing without consent, adopt policies for client data from acquisitions and train its staff.

Authority / court

Privacy Commissioner for Personal Data (PCPD), Hongkong

Area of law

Data protection · Data subject rights and transparency

Legal basis

Personal Data (Privacy) Ordinance (Cap. 486), Schedule 1, Data Protection Principle 3(1); Enforcement Notice nach s. 50(1)

Action

Order

Status of proceedings

unknown

Sector

Healthcare

Published

14 Nov 2022

Checked against the official source on 7 Oct 2026 · Company name anonymised since 14 Nov 2024 · Direct link

On 10 November 2022 the ICO issued a reprimand to a London NHS hospital trust. According to the ICO's findings, from May 2013 the trust stored hysteroscopy scans on USB sticks for nine years without backing them up to its servers, contrary to its own policy; the two remaining encrypted sticks became inaccessible on 5 April 2018, affecting between 4,000 and 10,000 people. The trust did not initially recognise the incident as a personal data breach and reported it late; there were no risk assessments, no training and no designated information asset owners. The ICO found infringements of Articles 5(1)(f) and 24(1) UK GDPR.

Authority / court

Information Commissioner's Office (ICO)

Area of law

Data protection · Data breaches and data security

Legal basis

Art. 5(1)(f) und 24(1) UK GDPR; Verwarnung nach Art. 58 UK GDPR

Action

Reprimand or warning

Status of proceedings

unknown

Sector

Healthcare

Checked against the official source on 28 Sep 2026 · Version 4 · Company name anonymised since 10 Nov 2024 · Direct link

The competition authority fined a Portuguese subsidiary of the diagnostics group 5,038,200 EUR because from November 2015 to August 2021 it colluded with other providers in public teleradiology tenders by state hospitals, fixing winners and bid prices and sharing the market. The fine was reduced in the settlement procedure.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Cartels and collusion

Legal basis

Art. 9 Lei n.º 19/2012 (Lei da Concorrência); Art. 101 AEUV

Action

Fine

Status of proceedings

final

Sector

Healthcare

Mitigating circumstances

Settlement procedure (transação) with admission and waiver of appeal; fine reduced.

Published

31 Oct 2022

Checked against the official source on 28 Sep 2026 · Company name anonymised since 14 Oct 2024 · Direct link

From 29 April 2009 to 23 December 2020, the manufacturer, as the dominant manufacturer and wholesaler of spectacle lenses, pursued a discriminatory commercial policy towards websites offering prescription glasses entirely online, with the aim of hindering the development of online distribution in France. The Autorité de la concurrence (French Competition Authority) imposed EUR 81,067,400, of which EUR 15,400,000 jointly with the parent company. The Cour d’appel de Paris (Paris Court of Appeal) upheld the decision on 12 December 2024.

Authority / court

Autorité de la concurrence

Area of law

Competition law · Abuse of market power

Legal basis

Art. L. 420-2 Code de commerce; Art. 102 AEUV

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Employees

10,000 or more

Published

8 Nov 2022

Checked against the official source on 7 Oct 2026 · Version 2 · Company name anonymised since 6 Oct 2024 · Direct link

The competition authority fined the charitable institution 2,500,000 EUR because it acquired sole control of the operating company of a hospital on 14 December 2020 but only notified the merger on 28 May 2021, i.e. after completion.

Authority / court

Autoridade da Concorrência (AdC)

Area of law

Competition law · Merger control

Legal basis

Lei n.º 19/2012 (Lei da Concorrência): Anmelde- und Vollzugsverbot für Zusammenschlüsse

Action

Fine

Status of proceedings

unknown

Sector

Healthcare

Mitigating circumstances

Cooperation with the authority, voluntary late notification, suspension of voting rights and a request for derogation from the standstill obligation were taken into account.

Published

7 Sep 2022

Checked against the official source on 28 Sep 2026 · Company name anonymised since 6 Sep 2024 · Direct link