$2.7M BCHP Data Breach Settlement Also Binds IT Vendor XTIUM

$2.7M BCHP Data Breach Settlement Also Binds IT Vendor XTIUM

The New York and Connecticut attorneys general announced a $2.7 million data security settlement on October 16, 2026 with Boston Children's Health Physicians and its IT management company, XTIUM. Both companies are named respondents, and the security obligations run against each of them separately.

Information last verified on October 19, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article covers the New York Assurance of Discontinuance and the parallel Connecticut announcement, plus the New York and federal law the document invokes. It does not cover other states' data security statutes, private class litigation arising from the same breach, or any consumer claims process, because an assurance of discontinuance creates none. For the underlying rules, see New York's SHIELD Act and consumer privacy rights.

What Happened

On October 16, 2026, the New York Attorney General's Bureau of Internet and Technology executed Assurance of Discontinuance No. 2026-057 with Boston Children's Health Physicians, LLP and XTIUM. The Assurance states that its effective date is the date the OAG signs it, and Assistant Attorney General Gena Feist signed on October 16, 2026. BCHP is a multi-site pediatric practice based in New York, with doctors in more than 60 New York locations and five in Connecticut and a network of over 300 physicians. The OAG identifies BCHP as a HIPAA covered entity and XTIUM as its contractual business associate.

Two separate data breaches sit behind the settlement, both traced to a single intrusion. During August 2024, a threat actor infiltrated XTIUM, and that initial infiltration reached eighteen of XTIUM's client systems. Of those eighteen clients, the Assurance says, only BCHP suffered a data breach. XTIUM notified BCHP of its own system breach on September 6, 2024. On September 7, BCHP reset its system user passwords but, according to the OAG, took no further step such as resetting administrator passwords or isolating its network from the internet while it confirmed whether it had been breached. BCHP detected unauthorized activity on September 10, 2024, cut off internet access, and brought its systems back online by September 13.

The vendor relationship is central to the findings. BCHP had only two employees overseeing IT and information security at the time of the fall 2024 breach and outsourced heavily. One IT vendor handled both management and security for the active patient records system, which was not breached. XTIUM, formed when Axispoint Technology Solutions Group, Inc. merged with Evolve IP, was contractually responsible for the management of, and not the security for, BCHP's other IT systems. Those were the systems the attacker reached. The Assurance draws the industry distinction explicitly: a managed service provider delivers administrative and operational technology services, while a managed security service provider supplies threat detection, threat prevention, risk management, scanning, incident response and compliance.

The OAG findings describe how the access chained together. XTIUM managed certain functions inside the BCHP environment using a single shared administrative account with unrestricted access and unlimited privileges. After the attacker used that account, it compromised four more unrestricted BCHP administrative accounts, which were non-human service accounts that the OAG says should have been barred from interactive human logins. From there the attacker reached BCHP's entire system and exfiltrated an unencrypted archive of patient billing records containing patient and guarantor names, addresses, dates of birth, Social Security information, health insurance information, billing information and treatment information.

The scale is set out in two places. Paragraph 13 states that the records of approximately 825,000 New Yorkers were exfiltrated, with more than 170,000 of those including a New York resident's Social Security number, driver's license number, or both. Paragraph 27 states that the unencrypted archive itself held the personal information of approximately 820,000 New Yorkers, and that over 4,000 BCHP employee records were exfiltrated from a different database. The Connecticut announcement puts the Connecticut figure at 62,871 residents. XTIUM's own breach cost about 1,000 employee records, including more than 200 New York residents and, per the Connecticut release, 16 Connecticut residents.

Two further findings matter for how the OAG reasoned. BCHP participated in a third-party information security audit in 2023 that identified, among other issues, its lack of common information security policies and procedures, the absence of certain standard security tools, the absence of an incident response plan, the absence of a security vendor assessment program, and what the Assurance calls "the lack of clarity regarding whether XTIUM or BCHP was providing specific services to secure the BCHP information system." The OAG found BCHP did not reasonably respond to that audit. Separately, the OAG found that multiple BCHP executives responsible for data security knew for over two years before the breach that BCHP hosted an unencrypted archive of more than a million patient payment records, and that the archive stayed essentially unprotected until it was taken. The Assurance also notes that both companies cooperated but at times supplied incorrect, incomplete or inconsistent information.

On money, the Assurance and the press releases describe the same deal from different angles. Paragraph 58 sets a total of $4,000,000 in penalties and costs: an initial $2,700,000 payable by XTIUM and BCHP within 30 days of the Effective Date and divided between the two attorneys general in amounts they designate, plus a second payment of $1,300,000 by BCHP that is suspended unless the OAG finds that BCHP materially breached the Assurance within 10 years of execution, in which case it becomes due within 60 days. Both attorneys general describe the division as a $2.1 million penalty to New York and $540,000 to Connecticut, with an additional $1,040,000 and $260,000 respectively if BCHP violates the terms. The Assurance itself does not allocate the state shares. In the releases, Connecticut's $540,000 is exactly one fifth of the $2,700,000 initial payment and its contingent $260,000 is exactly one fifth of the $1,300,000 suspended payment, so New York's share on the same split would be $2,160,000, which the releases appear to round to $2.1 million.

Connecticut's role is described in a footnote to the Assurance, which says the investigation was conducted with the Connecticut Attorney General's office, which entered into a similar agreement with the respondents. Connecticut's October 16, 2026 release confirms the joint action and names the Connecticut staff who worked it, but Connecticut's own agreement document was not published on the Attorney General's site as of October 19, 2026, so this article does not characterize its terms.

What the Law Actually Says

The OAG opened the investigation under New York Executive Law section 63(12), GBL section 899-bb, and the HIPAA rules at 45 C.F.R. Part 160 and Part 164 Subparts A and C. Each of those does a distinct job.

Executive Law section 63(12) is the Attorney General's general business-fraud and illegality authority. It applies whenever a person "shall engage in repeated fraudulent or illegal acts or otherwise demonstrate persistent fraud or illegality in the carrying on, conducting or transaction of business," and it lets the Attorney General apply to the Supreme Court of the State of New York for an order enjoining the conduct and directing restitution and damages. The statute's own definitions are broad: "persistent fraud" or "illegality" includes continuance or carrying on of any fraudulent or illegal act or conduct, and "repeated" includes conduct that affects more than one person. The practical effect is that a violation of another statute, such as the security duty discussed next, can be pleaded as illegality under section 63(12).

GBL section 899-bb is the data security provision added by the SHIELD Act, and it is the one that reaches an IT vendor as readily as a medical practice. Subdivision 2(a) states that any person or business that owns or licenses computerized data which includes the private information of a resident of New York "shall develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity" of that information, including its disposal. The duty is not limited to health care, and it is not limited to the entity a patient deals with. Subdivision 2(b) deems an entity compliant if it is a "compliant regulated entity," a defined term covering entities subject to and in compliance with listed federal or New York data security requirements including HIPAA, or if it implements a data security program with the specified administrative, technical and physical elements. The definitional hook is narrower than many readers expect: "private information" borrows the meaning in GBL section 899-aa(1)(b), which turns on personal information combined with a listed data element, such as a Social Security number or driver's license number, where the element or the combination is not encrypted or is encrypted with a key that was also taken. That is why the unencrypted state of the BCHP archive carries so much weight in the findings.

Section 899-aa is the companion notification statute and explains what BCHP had to do after discovery. It requires disclosure to any New York resident whose private information was, or is reasonably believed to have been, accessed or acquired without valid authorization, in the most expedient time possible and without unreasonable delay, and provides that notification "shall be made within thirty days after the breach has been discovered," subject to law enforcement delay. Subdivision 8 adds notice to the Attorney General, the Department of State and the Division of State Police, and subdivision 9 requires a covered entity that notifies the federal Secretary of Health and Human Services to notify the Attorney General within five business days. We cover the mechanics in detail in our guide to New York's breach notification timetable, and Connecticut imposes its own parallel obligations, explained in our page on reporting a breach to Connecticut regulators. The Assurance records that BCHP notified individuals as required by federal and state law.

The HIPAA Security Rule supplies the federal layer. 45 C.F.R. section 164.306(a) requires covered entities and business associates to ensure the confidentiality, integrity and availability of all electronic protected health information they create, receive, maintain or transmit, and to protect against reasonably anticipated threats. The rule is deliberately flexible: section 164.306(b) tells entities to weigh their size, complexity, technical infrastructure, cost and the probability and criticality of risks, and section 164.306(d) splits implementation specifications into "required" and "addressable," with an addressable specification satisfied by assessing it and either implementing it or documenting why that is not reasonable and appropriate and implementing an equivalent alternative. Several controls at issue here are required, including risk analysis and information system activity review under section 164.308(a)(1)(ii)(A) and (D). Others are addressable, including access authorization under section 164.308(a)(4)(ii)(B) and encryption under section 164.312(a)(2)(iv) and (e)(2)(ii). Section 164.314(a)(2)(i) requires a business associate contract to obligate the vendor to comply with the Security Rule and to report security incidents to the covered entity. Our walkthrough of what a HIPAA breach report has to contain covers the notification side at Part 164 Subpart D.

Finally, the instrument itself is a creature of Executive Law section 63(15). Where the Attorney General has authority to bring a civil action or proceeding, that subdivision allows acceptance of "an assurance of discontinuance of any act or practice in violation of such law" in lieu of suing, and may include voluntary payment of the Attorney General's reasonable investigation costs. It also provides that evidence of a violation of the assurance "shall constitute prima facie proof of violation of the applicable law" in a later civil action by the Attorney General. The Assurance tracks that language at paragraph 34, where the OAG states it is willing to accept the Assurance in lieu of commencing a statutory proceeding, and at paragraph 59(d). Paragraph 33 records that XTIUM and BCHP neither admit nor deny the findings, and paragraph 61 states the Assurance should not be construed as an admission of liability by any respondent.

What the Settlement Requires

The relief section is written as a security program specification with dates attached, and most of it runs against "each Respondent" rather than the two jointly. The Effective Date is October 16, 2026, so the deadlines below are measured from that day.

General compliance. Each respondent must comply with Executive Law section 63(12), GBL section 899-bb, the HIPAA Security Rule at Part 160 and Part 164 Subparts A and C, and the Breach Notification Rule at Part 164 Subpart D, in its handling of consumer personal information, a defined term covering the private information and protected health information of anyone who resides or has resided in New York.

Information security program. Each respondent must maintain and document a written program designed in accordance with "the principles of zero trust architecture," with risk assessment, safeguard sufficiency review, effectiveness testing and program review each performed at least annually, and a standing duty to design, implement and maintain safeguards proportionate to the respondent's size, activities and the sensitivity of the data. Each must designate a qualified Chief Information Security Officer who reports at least quarterly to the chief executive and at least semi-annually to the board or equivalent, in writing, on staffing and budget sufficiency, implementation progress, challenges, emerging risks and barriers.

Notice and training, 60 days. Management-level employees responsible for the program must receive notice of the Assurance's requirements and appropriate training within 60 days of the Effective Date, which falls on December 15, 2026, or within 30 days of an employee first assuming such responsibility.

Account access management, 90 days. By January 14, 2027, each respondent must adopt or update policies and procedures, enforced with industry standard tools, covering ten subjects for all accounts including service and non-human accounts: account permissions and restrictions, access segmentation, access control, account monitoring and logging, privileged account management, principle of least privilege, role based access control, access recertification, managed detection and response, and governance, risk and compliance reviews.

Data inventory, 180 days. By April 14, 2027, each respondent must build and then annually update an inventory of every instance in which it handles private information, mapping complete data flows including API calls.

Third-party assessment, 180 days. By the same date, each respondent must obtain a comprehensive independent assessment of its network security, documented as a Third-Party Assessment Report and delivered to the OAG within two weeks of completion, then repeated annually for three years and retained for six years from each report's date. The assessor must employ at least one person qualified as a CISSP or CISA, or similarly qualified, with at least five years of experience evaluating information system security.

Ongoing controls. Authentication must include multifactor authentication or a reasonably equivalent control for access to consumer personal information and for remote network access; no credential may be accessible to more than one individual's account; and non-human accounts must be inaccessible to human login. Monitoring must provide centralized logging and aggregation plus alerting on suspicious activity, and the Assurance states that activity logs should be immediately accessible for at least 90 days and stored for at least one year from the date logged. Respondents must encrypt consumer personal information using a method appropriate to its sensitivity, segment their networks so cross-partition communication is limited to business need, maintain vendor and client risk assessment policies for IT service relationships, document which entity and which individuals own each element of the program, and promptly investigate and remediate on awareness of a reasonable risk of a security event. Where a respondent contracts out services covered by the Assurance, it must take reasonable steps to see that the material terms are satisfied.

Certification, one year, BCHP only. This obligation is not symmetrical. BCHP must give the OAG a compliance certification within one year of the Effective Date, then annually for five years, and within 90 days of an OAG request for an additional four years, each signed under penalty of perjury by its Chief Executive Officer, Chief Operating Officer and Chief Information Security Officer. Each respondent must retain the documentation required by paragraphs 37 through 56 for at least six years and produce it to the OAG within 14 days of a written request.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The structural point in Assurance No. 2026-057 is that the vendor stands on its own footing. GBL section 899-bb(2)(a) attaches to any person or business that owns or licenses computerized data which includes the private information of a New York resident, and the section writes in no exemption for an entity that administers someone else's systems. Applying that duty to a vendor in XTIUM's position is the OAG's reading, and here it did not have to stand alone, because XTIUM also held private information of its own. XTIUM held BCHP data in the course of its work and also held its own employee records, including those of over 200 New Yorkers, and the OAG made separate findings that it failed to safeguard both. The HIPAA layer points the same way, since 45 C.F.R. section 164.302 applies the Security Rule to business associates as well as covered entities.

The findings also show what the contract did not settle. XTIUM was contractually responsible for management rather than security of the systems that were breached, and the Assurance's description of the difference between a managed service provider and a managed security service provider explains why that line mattered operationally. But the OAG did not treat the contractual silence as the end of the inquiry. Paragraph 19 finds that XTIUM neither requested BCHP's security policies nor applied common standard practices where BCHP supplied none, and that it should have secured the client accounts it used regardless. The 2023 audit had already flagged the ambiguity about who was securing what. The relief then addresses that ambiguity directly through the responsibility documentation in paragraph 42(c) and the vendor and client risk assessments in paragraph 43.

It is also worth noticing how the relief relates to the federal baseline the same document invokes. Several obligations are stated more firmly in the Assurance than in the Security Rule text. Encryption is an addressable implementation specification at 45 C.F.R. section 164.312(a)(2)(iv) and (e)(2)(ii), satisfiable by documented analysis and an equivalent alternative, while paragraph 47 of the Assurance requires encryption of consumer personal information using a method appropriate to its sensitivity. Section 164.312(d) requires procedures to verify that a person seeking access is the one claimed, without naming a method, while paragraph 45 names multifactor authentication or a reasonably equivalent control. Section 164.308(a)(1)(ii)(D) requires regular review of information system activity records without specifying an interval, while paragraph 46 states that activity logs should be immediately accessible for at least 90 days and stored for at least a year. Zero trust architecture does not appear in the Security Rule at all, and it anchors the program requirement at paragraph 37. For an entity trying to read a standard of care out of public documents, the settlement text is the more specific of the two.

Two limits on all of this deserve equal weight. First, these are OAG findings accepted under Executive Law section 63(15) in lieu of a proceeding. No court weighed the evidence, both respondents neither admitted nor denied the findings, and paragraph 61 says the document is not an admission of liability and is not intended for use by any third party in another proceeding. Second, an assurance binds only its signatories. What it supplies to everyone else is not a rule but a published record of which controls one enforcement office, examining a specific set of facts, treated as the reasonable safeguards that section 899-bb requires.

How This Affects You

If you received a breach notice from Boston Children's Health Physicians about the 2024 incident, the settlement does not change your position directly. An assurance of discontinuance is an agreement between the attorneys general and the companies, and the $2,700,000 initial payment is penalties and costs payable to New York and Connecticut under paragraph 58. There is no settlement fund, no claim form and no eligibility process in this document, and nothing in it requires any payment to an individual. The consumer remediation the Assurance records is the notification BCHP sent and the one year of free credit monitoring it offered to affected individuals.

Because Social Security numbers and driver's license numbers were among the data the OAG says was taken from more than 170,000 New York records, the general protections for identity-theft risk are the relevant ones rather than anything settlement-specific. A security freeze at each of the national credit bureaus is free under federal law and is independent of any monitoring an organization offers; our guide to placing and lifting a credit freeze walks through the mechanics. BCHP's breach notices to affected individuals, which paragraph 14 records, long predate this settlement, so a new message claiming to offer a payout from the October 2026 settlement would not match anything in the document.

If you run or advise an organization that holds New Yorkers' private information, the reach of the statute is the practical takeaway. GBL section 899-bb applies whether or not you are in health care and whether or not the individual is your customer, and this settlement shows the OAG declining to treat a client contract that assigns no security duties as an answer. Where an entity is a HIPAA covered entity or business associate, the Security Rule applies in parallel, and the definitions in Part 164 Subpart C make business associates directly responsible. None of this is a substitute for advice about your own arrangements.

This is general legal information, not legal advice. It covers New York and Connecticut state enforcement and the federal HIPAA Security Rule, and reflects primary sources verified on October 19, 2026. Laws change, this story is developing, and the Connecticut agreement was not publicly available as of that date. Consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• New York Data Privacy Laws: SHIELD Act and consumer rights
• New York data breach notification requirements
• Connecticut data breach notification requirements
• How to report a HIPAA breach
• How to freeze your credit after a data breach

---

Last updated: 2026-10-19. Details verified as of 2026-10-19.

Frequently Asked Questions

Will affected patients get money from the BCHP settlement?

No. Paragraph 58 of Assurance No. 2026-057 directs the $2,700,000 initial payment to the New York and Connecticut Attorneys General as penalties and costs. The document creates no settlement fund, no claim form and no consumer claims process.

Did BCHP or XTIUM admit they violated the law?

No. Paragraph 33 states that XTIUM and BCHP neither admit nor deny the OAG's findings, and paragraph 61 states the Assurance should not be construed as an admission of liability. No court adjudicated a violation.

What is an assurance of discontinuance?

Under New York Executive Law section 63(15), the Attorney General may accept an assurance of discontinuance in lieu of bringing a civil action or proceeding. Evidence of a violation of the assurance is prima facie proof of a violation of the underlying law in a later action by the Attorney General.

How many people were affected?

The Assurance states that records of approximately 825,000 New Yorkers were exfiltrated, including Social Security or driver's license numbers for over 170,000 of them, and that over 4,000 BCHP employee records were taken from a separate database. Connecticut reports 62,871 residents. About 1,000 XTIUM employee records were also taken, including over 200 New Yorkers and 16 Connecticut residents.

Can New York hold an IT vendor responsible for a client's data?

GBL section 899-bb(2)(a) imposes the reasonable-safeguards duty on any person or business that owns or licenses computerized data which includes the private information of a New York resident, with no health care limitation. The OAG made separate findings against XTIUM under that section and under the HIPAA Security Rule, which 45 C.F.R. section 164.302 applies to business associates.

What happens if BCHP does not comply with the settlement?

Paragraph 58 suspends a second payment of $1,300,000 by BCHP, which becomes due within 60 days if the OAG finds BCHP materially breached the Assurance within 10 years of execution. Paragraph 59 also tolls time-related defenses and makes evidence of a violation prima facie proof under Executive Law section 63(15).

What are the compliance deadlines in the settlement?

They run from the October 16, 2026 Effective Date: employee notice and training within 60 days, account access management policies within 90 days, and both a data inventory and an independent third-party security assessment within 180 days. BCHP's first sworn compliance certification is due within one year.

Does the settlement change what New York requires of everyone else?

No. An assurance binds its signatories. The standing duty is still GBL section 899-bb's reasonable safeguards requirement, with the notification rules in GBL section 899-aa and, for covered entities and business associates, the HIPAA Security Rule at 45 C.F.R. Part 164 Subpart C.