Most HIPAA covered entities still treat the federal Office for Civil Rights as the single regulatory threat after a breach. That mental model is now incomplete in a way that costs money. The New York State Department of Financial Services last week reached a $2.25 million settlement with Delta Dental over the 2023 MOVEit breach — a case where the technical failure was a third-party software vulnerability, not a Delta Dental control gap. NYSDFS levied the penalty anyway. State financial regulators have become the second front, and the front is widening.

What the action says

NYSDFS is one of the most aggressive state-level cybersecurity regulators in the United States. Its 23 NYCRR 500 framework applies to covered insurers — including dental insurance carriers — and imposes affirmative security requirements that operate independently of HIPAA. The Delta Dental settlement was anchored in the state regulation, not federal HIPAA: the per-individual New York exposure was the basis, and the state-rule requirements were the compliance failure.

The structural feature worth noticing is that the underlying technical breach was a zero-day in Progress Software's MOVEit Transfer product, exploited by the Clop ransomware group during the 2023 supply-chain campaign. Delta Dental was one of dozens of organizations affected. There was no reasonable patching path before exploitation. NYSDFS extracted the settlement anyway — based on what the regulation requires regardless of vendor failures: documented vendor risk management, incident response readiness, defined containment controls.

What it shows

State-level enforcement is following a pattern that's worth tracking explicitly. New York is leading. California, Connecticut, and Texas have moved in similar directions. The next twenty-four months will likely see other state insurance commissioners and attorneys general bringing cases that look structurally like the Delta Dental settlement: a breach occurs upstream at a vendor, the covered entity gets penalized for inadequate vendor oversight regardless of the technical proximate cause.

This shifts the practical regulatory exposure for healthcare practices in two ways. First, the trigger for state action is broader than HIPAA — state breach notification laws cover smaller incidents, and state cybersecurity rules apply affirmative requirements rather than only post-incident accountability. Second, the timeline is faster. State enforcement actions typically resolve in 12–24 months. Comparable HHS OCR resolution agreements often take three to five years.

For an independent practice, the practical effect is that "we'll deal with regulators if and when something happens" — already inadequate as a strategy under HIPAA — is now even less viable.

What independent practices should take from this

Three operational implications are worth folding into the compliance program now, before any state regulator reaches out.

Vendor risk management has to be evidenced, not assumed. A signed Business Associate Agreement is the floor, not the ceiling. Document the vendor-by-vendor security review process, retain the assessments, and update them on a defined cadence. When a regulator asks how the practice oversees vendor security, the answer should be a stack of dated artifacts, not a description of intent.

Incident response readiness should be tested, not planned. State regulations increasingly include specific incident response timing requirements. NYSDFS Part 500 specifies 72-hour reporting for material cybersecurity events. Documented tabletop exercises that simulate vendor-originated incidents — with the practice's actual contact lists, decision tree, and communication paths — substantially improve both the response itself and the regulator's later judgment of due care.

Multi-state exposure should be inventoried. Practices that serve patients across state lines, accept insurance from multi-state carriers, or use vendors with multi-state customer bases now have potential exposure under multiple state regimes. The compliance program needs to know which state rules apply, not just whether HIPAA applies.

The Delta Dental settlement is not anomalous; it's a leading edge. The architecture of healthcare regulatory enforcement is becoming federated. Practices that organize their compliance program around that reality will weather the next cycle of enforcement actions. Practices that don't will keep getting surprised by penalties that arrive from agencies they weren't watching.

Read the original at DataBreaches.net →