ProPublica reports that medical images and health data covering more than five million US patients can be accessed online, an investigation by ProPublica and the German broadcaster Bayerischer Rundfunk indicates. Researchers identified 187 servers located in the US “that were unprotected by passwords or basic security precautions” that were “used in doctors’ offices, medical-imaging centers and mobile X-ray services.” Former HHS privacy official Joy Pritts “said the government isn’t tough enough in policing patient privacy breaches” and “cited an April announcement from HHS that lowered the maximum annual fine, from $1.5 million to $250,000, for what’s known as ‘corrected willful neglect.’” Moreover, “a spokeswoman for HHS’ Office for Civil Rights, which enforces HIPAA violations, said it wouldn’t comment on open or potential investigations.”

From the news release of the American Association for Justice.