This is pretty wild. HIPAA does not fuck around, even a minor infringement is taken very seriously. The lawsuits are gonna be something else.
Prior to that, it was just a polite suggestion.
I work in publicly funded mental health and our responses to possible/actual HIPAA breaches are monitored very closely by our funders. So even if an event occurs that is not deemed to be an actual breach, if our response/investigation/corrective action is found to be unsatisfactory, our county/state/fed contracts, foundation grants, and Joint Commission Accreditation could be altered/canceled.
Would be great to have a retrospective on this a year from now. I realize it isnt HIPPA, but from what I see from Credit Agency breaches, regulations are often just suggestions and there are no real consequences. Would be happy to see otherwise.
While infringements are taken seriously, and intentional infringement (e.g. looking up the records of a famous celebrity being treated in your hospital without reason to) results in hefty penalities, 99% sure this was a case of them using Google Analytics/Tag Manager and accidentally tagging stuff with protected PII fields. Yes, definitely a serious issue, but on my scale of "breaches I would be concerned about", this one would actually be relatively low.