It would seem that they have violated HIPAA by both losing the data and not informing anyone about it. Violations and Penalties here: http://www.ama-assn.org/

It would seem that they have violated HIPAA by both losing the data and not informing anyone about it. Violations and Penalties here: http://www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/coding-billing-insurance/hipaahealth-insurance-portability-accountability-act/hipaa-violations-enforcement.shtml http://www.ama-assn.org/ama/pub/physician-resources/solution... Note that "The DOJ concluded that the criminal penalties for a violation of HIPAA are directly applicable to covered entities—including health plans, health care clearinghouses, health care providers who transmit claims in electronic form, and Medicare prescription drug card sponsors." I would think that a data loss like this would likely hit the maximum $1.5m fine..