Penalty Amount
$495,000
Consumers Affected
14,663
The New Jersey Attorney General settled with Diamond Institute for Infertility and Menopause, LLC, following a data breach that exposed the electronic protected health information (ePHI) of 14,663 patients. The investigation found the clinic failed to implement required HIPAA Security Rule safeguards, including risk assessments, encryption, and access controls. The $495,000 settlement includes civil penalties and requires the clinic to implement a comprehensive information security program and corrective actions.
Diamond must pay $495,000 ($412,300 in civil penalties and $82,700 in costs/fees). The settlement mandates the development and implementation of a comprehensive information security program, appointment of a qualified HIPAA Privacy and Security Officer, employee training, a written incident response plan, and specific technical safeguards including encryption, logging, access controls, risk assessments, and password management.
In-house legal teams should review vendor agreements (especially Business Associate Agreements under HIPAA), customer/patient service agreements, and employee access policies. Key clauses to scrutinize include data security requirements (encryption, access controls), breach notification timelines and procedures, audit and monitoring rights, and corrective action plan obligations. Given the settlement's focus on inadequate risk assessments and encryption, contracts should be updated to mandate regular security risk assessments, specify encryption standards for ePHI, require prompt breach reporting consistent with NJ and HIPAA timelines, and include enforceable remedies for security failures.
Entity
Diamond Institute for Infertility and Menopause, LLC
Also known as: Diamond Institute for Infertility and Menopause
Industry
HealthcareOfficial Press Release
https://www.njoag.gov/acting-ag-bruck-announces-settlement-with-fertility-clinic-over-cybersecurity-lapses-and-data-breach/
Diamond Institute
https://www.nj.gov/oag/newsreleases21/Diamond-Institute.pdf
New Jersey Attorney General Enforcement Page
https://www.njoag.gov/about/divisions-and-offices/division-of-consumer-affairs/
"Diamond Institute for Infertility and Menopause, LLC (“Diamond”)"
"The settlement of $495,000 includes $412,300 in civil penalties and $82,700 in investigative costs and attorneys’ fees."
"failing to conduct an accurate and thorough risk assessment of potential risk and vulnerabilities to the confidentiality, integrity and availability of ePHI; failing to implement a mechanism to encrypt ePHI; failing to review and modify security measures as needed to continue reasonable and appropriate protection of ePHI; failing to implement proper procedures for creating, changing, and safeguarding passwords; and failing to implement procedures to verify that the person seeking access to ePHI is who they claim to be."
"compromised the personal information of 14,663 patients, including 11,071 New Jersey residents."
"developing and implementing a comprehensive information security program that includes regular updates to keep pace with changes in technology and security threats; appointing a new HIPAA Privacy and Security Officer... training employees... developing and implementing a written incident response and data breach notification plan... implementing personal information safeguards and controls, including encryption, logging and monitoring, access controls, a risk assessment program, and password management."
"violated the New Jersey Consumer Fraud Act, the federal Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule, and the HIPAA Security Rule"
A multistate coalition co-led by New Jersey won a federal court order rejecting the Trump Administration’s decision not to request funding for the CFPB. The order struck down that decision and directed the Administration to follow the law and fund the agency; no monetary penalty or privacy violation is described.
New Jersey’s Attorney General and Division of Consumer Affairs alerted the public that three synthetic kratom-related compounds became illegal to possess or sell in the state under a temporary federal scheduling order. The release describes a controlled-substance alert, not a privacy enforcement action, and identifies no company, privacy violation, or monetary penalty.
$2.3M
Laboratory Corporation of America Holdings agreed to pay $2,287,455 to participating states and strengthen its security and vendor-management practices following an investigation into the 2019 breach at its debt-collection vendor, AMCA. The breach potentially exposed information of more than 27.5 million people nationwide, including sensitive information belonging to approximately 10.2 million LabCorp patients.
$694.0M
New Jersey's Attorney General and Division of Consumer Affairs, along with 41 Attorneys General, reached a $694 million settlement with subprime auto lender Credit Acceptance Corporation over allegations it originated unaffordable loans its own systems predicted borrowers could not repay, employed aggressive debt-collection tactics, and failed to prevent deceptive vehicle-service contract and GAP product 'packing' by dealers. The multistate settlement stepped in after the CFPB permanently dropped its 2023 enforcement action against CAC in 2025. CAC will provide $60 million in cash restitution, $634 million in debt relief, an additional $15 million to the states, and implement injunctive lending reforms including loan off ramps, pre-loan disclosures, add-on packing safeguards, and a seven-year vehicle price cap. Note: this is a consumer-protection lending enforcement action, not a privacy matter; violation categories are best-fit mappings from the available taxonomy.
$650K
The New Jersey Attorney General and Division of Consumer Affairs announced that Match Group, Inc. will pay $650,000 and change its business practices to settle allegations that it misrepresented or failed to disclose its criminal background screening policies and practices to New Jersey users, violating the New Jersey Consumer Fraud Act and the Internet Dating Safety Act. Under a Consent Order, Match must accurately represent its screening policies, notify existing New Jersey members of updated disclosures within 150 days, and post clear and conspicuous disclosures and safety notifications about the limitations of criminal background screenings.
$96.5M
New Jersey and a coalition of states and territories obtained preliminary approval for a plan to distribute funds from settlements with generic drug manufacturers accused of conspiring to raise drug prices. The settlements total approximately $96.5 million, and eligible consumers may submit claims for compensation.