In late September, Anthem Inc. entered into a $39.5 million settlement for a 2014 data breach that affected nearly 79 million individuals.
[1] About a week later, CHS/Community Health Systems Inc. agreed to pay $5 million for a breach that same year; 6.1 million records had been hacked.
[2]
Premera Blue Cross, in July of last year, agreed to pay $10 million for its 2015 breach that exposed the protected health information (PHI) of more than 10.4 million people.
[3] More than half of that amount $5.4 million went to Washington State alone, as its state Attorney General (AG) Bob Ferguson had spearheaded the investigation.
Because these payments all came amid costly settlements announced by the HHS Office for Civil Rights (with the same organizations), HIPAA privacy and security officials might have missed the fact that all four settlements were not with OCR but were negotiated by state AGs working together.