New York and Connecticut reached a $2.7 million settlement with Boston Children’s Health Physicians and IT provider XTIUM following a 2024 cyberattack that exposed sensitive information. The states identified deficiencies involving governance, vendor oversight, privileged access, logging and monitoring, network segmentation, encryption, incident response, and remediation of prior audit findings.
The practical lesson is straightforward: outsourcing IT functions does not outsource legal accountability. Customers must define and oversee security responsibilities, while service providers remain responsible for reasonable controls within the systems and tools they manage. The settlement requires stronger security programs, clearer responsibility assignments, data inventories, multifactor authentication, centralized logging, encryption, vendor-risk procedures, and independent assessments.
What Businesses Should Do Now
- Confirm that contracts and responsibility matrices clearly allocate IT and security functions.
- Remediate known audit findings and document closure decisions.
- Restrict and monitor privileged, shared, service, and remote-support accounts.
- Test vendor oversight, logging, encryption, segmentation, incident response, and data-inventory practices.
The CommLaw Group Can Help
The CommLaw Group advises businesses on cybersecurity, privacy, vendor-risk management, incident response, and regulatory investigations. For assistance evaluating these developments or strengthening compliance programs, please contact:
Brian Alexander | bal@commlawgroup.com
Diana James | daj@commlawgroup.com
Primary sources: New York announcement | Connecticut announcement | New York Assurance of Discontinuance