Ambulance Billing Firm Pays $515K Fine to 2 States in Hack

Comstar Paid Feds $75K Last Year to Settle HIPAA Allegations in Same 2022 Breach Marianne Kolbasuk McGee (HealthInfoSec) • January 29, 2026

An ambulance billing and collections firm will pay $515,000 to Massachusetts and Connecticut regulators and implement an information security program to settle state investigations into a 2022 ransomware incident affecting the sensitive information of nearly 350,000 New Englanders.

See Also: Demonstrating HIPAA Compliance

The attorneys general of both states said Wednesday that Massachusetts-based Comstar agreed to pay Massachusetts $415,000 and Connecticut $100,000 to settle allegations the company violated federal HIPAA and state data privacy regulations.

A threat actor in March 2022 accessed, encrypted, and held for ransom files and servers maintained by Comstar, the ...