INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Massachusetts AG Settles HIPAA & MassHealth Fraud Allegations with Transformative

| 2026-10-22 11:04 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
The Massachusetts Attorney General launched an investigation into a data breach at Transformative Healthcare and Fallon in April 2023, which exposed the personal and protected health information of approximately 750,116 Massachusetts residents. The entities behind the incident are not specified as being directly responsible for it; however, the settlement agreement requires Transformative Healthcare and Fallon to ensure compliance with relevant regulations. The affected individuals include those whose names, contact information, dates of birth, driver’s license numbers, state identification numbers, Social Security numbers, medical information, and health insurance information were potentially stolen during an archiving process between February 17, 2023, and April 21, 2023. The attack appears to have been a targeted sector breach where unauthorized access occurred through systems containing the data of Transformative Healthcare patients and employees. As of now, the settlement agreement has resolved the combined allegations with a $1,000,000 financial penalty paid over five years.
Technical Mitigations AI-generated
• Patch systems containing the data of Transformative Healthcare patients and employees to prevent unauthorized access. • Implement a robust written information security program, including regular audits and incident response planning, as required by HIPAA 45 CFR Part 164, Subpart A (General Provisions of HIPAA). • Conduct thorough forensic investigations into suspected data breaches to identify the root cause and implement corrective measures.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope healthhealth transportationtransportation
Incident Timeline
‎February 17, 2023
General Document Context.
industry Health
General Document Context
industry Transportation
General Document Context
‎between February 17, 2023
Unauthorized third-party access to systems containing Transformative Healthcare patients' and employees' data occurred between February 17, 2023, and April 21, 2023.
‎April 21, 2023
Transformative Healthcare experienced a data breach, resulting in the exposure and potential theft of 750,116 Massachusetts residents' personal and protected health information.
industry Health
General Document Context
industry Transportation
General Document Context
organisation the Massachusetts Consumer Protection Act
The Massachusetts Attorney General launched an investigation into the data breach to assess compliance with the Massachusetts Consumer Protection Act, Massachusetts Data Security Law, and HIPAA.
organisation HIPAA
The Massachusetts Attorney General launched an investigation into the data breach to assess compliance with the Massachusetts Consumer Protection Act, Massachusetts Data Security Law, and HIPAA.
organisation Social Security
The impacted data included names, contact information, dates of birth, driver’s license numbers, state identification numbers, Social Security numbers, medical information, and health insurance information.
‎Oct 22, 2026
The Massachusetts AG settled HIPAA and MassHealth fraud allegations with Transformative Healthcare for a $1,000,000 financial penalty to be paid over five years.
industry Health
General Document Context
industry Transportation
General Document Context
organisation Transformative Healthcare Posted
Massachusetts AG Settles HIPAA & MassHealth Fraud Allegations with Transformative Healthcare Posted By Steve Alder on Oct 22, 2026
financial $1,000,000 $ financial penalty
Under the proposed consent judgment, the combined allegations have been resolved with a $1,000,000 financial penalty, which will be paid over five years.
‎2026/10/22
Transformative Healthcare and Fallon allegedly upcoded claims to MassHealth by billing for more expensive levels of service than they provided, including submitting false claims for Advanced Life Support services.
organisation HIPAA Journal
…ournal Privacy Policy In addition to the financial penalty, the settlement requires Transformative Healthcare and Fallon to ensure compliance with the Massachusetts Consumer Protection Act, Data Breach Notification Law, Data Security Regulations, Dispositions and Destruction of Records Law, and the HIPAA Privacy and Security Rules, and includes the requirement to destroy personal inform…
organisation Data Breach Notification Law
…ournal Privacy Policy In addition to the financial penalty, the settlement requires Transformative Healthcare and Fallon to ensure compliance with the Massachusetts Consumer Protection Act, Data Breach Notification Law, Data Security Regulations, Dispositions and Destruction of Records Law, and the HIPAA Privacy and Security Rules, and includes the requirement to destroy personal inform…
organisation the HIPAA Privacy and Security Rules
…ournal Privacy Policy In addition to the financial penalty, the settlement requires Transformative Healthcare and Fallon to ensure compliance with the Massachusetts Consumer Protection Act, Data Breach Notification Law, Data Security Regulations, Dispositions and Destruction of Records Law, and the HIPAA Privacy and Security Rules, and includes the requirement to destroy personal inform…
organisation Massachusetts AG
Massachusetts AG Settles HIPAA & MassHealth Fraud Allegations with Transformative Healthcare.
organisation Transformative Healthcare
Massachusetts AG Settles HIPAA & MassHealth Fraud Allegations with Transformative Healthcare.
organisation Massachusetts Data Security Law
The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts Data Security Law with the former medical transportation provider Transformative Healthcare, LLC, and its subsidiaries, Lifeline Ambulance Services, LLC and Lifeline Healthcare Solutions, LLC (Lifeline), and Fallon Service, LLC and Fallon…
organisation LLC
The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts Data Security Law with the former medical transportation provider Transformative Healthcare, LLC, and its subsidiaries, Lifeline Ambulance Services, LLC and Lifeline Healthcare Solutions, LLC (Lifeline), and Fallon Service, LLC and Fallon…
organisation Lifeline Ambulance Services
The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts Data Security Law with the former medical transportation provider Transformative Healthcare, LLC, and its subsidiaries, Lifeline Ambulance Services, LLC and Lifeline Healthcare Solutions, LLC (Lifeline), and Fallon Service, LLC and Fallon…
organisation Lifeline Healthcare Solutions
The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts Data Security Law with the former medical transportation provider Transformative Healthcare, LLC, and its subsidiaries, Lifeline Ambulance Services, LLC and Lifeline Healthcare Solutions, LLC (Lifeline), and Fallon Service, LLC and Fallon…
organisation Fallon Service
The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts Data Security Law with the former medical transportation provider Transformative Healthcare, LLC, and its subsidiaries, Lifeline Ambulance Services, LLC and Lifeline Healthcare Solutions, LLC (Lifeline), and Fallon Service, LLC and Fallon…
organisation Fallon Emergency Medical Services
The Massachusetts Attorney General has agreed to settle alleged violations of the Health Insurance Portability and Accountability Act (HIPAA) and Massachusetts Data Security Law with the former medical transportation provider Transformative Healthcare, LLC, and its subsidiaries, Lifeline Ambulance Services, LLC and Lifeline Healthcare Solutions, LLC (Lifeline), and Fallon Service, LLC and Fallon…
organisation MassHealth
The settlement agreement also resolves allegations that Fallon and Lifeline upcoded claims to MassHealth by billing for more expensive levels of service than they provided, including billing for emergency services when nonemergency level services were provided, and submitting false claims for Advanced Life Support services when the services provided did not meet the criteria for Advanced Life Su…
organisation Advanced Life Support
The settlement agreement also resolves allegations that Fallon and Lifeline upcoded claims to MassHealth by billing for more expensive levels of service than they provided, including billing for emergency services when nonemergency level services were provided, and submitting false claims for Advanced Life Support services when the services provided did not meet the criteria for Advanced Life Su…
organisation the Massachusetts Data Security Regulations
…ttorney General determined that Transformative Healthcare had failed to maintain an appropriate written information security program, and concluded that Transformative Healthcare and Fallon violated the Massachusetts Data Security Regulations and HIPAA 45 CFR Part 164, Subpart A (General Provisions of HIPAA), Subpart C (Security Standards for the Protection of Electronic Protected Health Informa…
organisation CFR
…ttorney General determined that Transformative Healthcare had failed to maintain an appropriate written information security program, and concluded that Transformative Healthcare and Fallon violated the Massachusetts Data Security Regulations and HIPAA 45 CFR Part 164, Subpart A (General Provisions of HIPAA), Subpart C (Security Standards for the Protection of Electronic Protected Health Informa…
organisation Subpart A
…ttorney General determined that Transformative Healthcare had failed to maintain an appropriate written information security program, and concluded that Transformative Healthcare and Fallon violated the Massachusetts Data Security Regulations and HIPAA 45 CFR Part 164, Subpart A (General Provisions of HIPAA), Subpart C (Security Standards for the Protection of Electronic Protected Health Informa…
Tactical Metrics
Metrics
financial
1,000,000
$ Financial Penalty
Under the proposed consent judgment, the combined allegations have been resolved with a $1,000,000 financial penalty, which will be paid over five years.
Intelligence Sources
HIPAA Journal 2026-10-22