Massachusetts Attorney General Andrea Joy Campbell has closed a case that braided two failures together. A $1,000,000 consent judgment, payable across five years, resolves allegations against Transformative Healthcare LLC and its former subsidiaries Lifeline Ambulance Services and Fallon Emergency Medical Services for exposing patient records and inflating MassHealth bills.
The exposure began inside an archiving process. Fallon spotted it on April 21, 2023, and investigators determined an unauthorized party held access from February 17 through that April date. Records for 750,116 Massachusetts residents were left reachable and potentially copied, covering names, contact detail, birth dates, license and state ID numbers, Social Security numbers, clinical information and insurance.
Prosecutors concluded the company never maintained a written information security program. The state found breaches of its Data Security Regulations and of HIPAA’s general provisions, Security Rule and Privacy Rule. Separately, Fallon and Lifeline were accused of upcoding claims, billing emergency transport where basic service was provided and claiming advanced life support that never met the criteria.
The remedy reaches past the money. Transformative and Fallon must comply with the state’s consumer protection, breach notification, records destruction and HIPAA frameworks, and must destroy personal and protected health information within 45 days of the judgment’s effective date.
Lifeline and Fallon were acquired by another Massachusetts operator in 2022 when Transformative wound down, which makes the case a closing argument for buyers: inherited subsidiaries inherit the security record.
State attorneys general remain the most active HIPAA enforcers, and joint data-security-plus-billing allegations are how those cases get large.
