Why This Actually Matters

This isn't corporate box-checking -- HIPAA violations carry real, escalating financial and legal consequences, and as a Business Associate, Comodo can be held directly liable, not just the practice.

Figures current as of the January 2026 federal inflation adjustment. These are per violation -- a single incident affecting many patient records, or a problem that goes uncorrected for many days, can be counted as many violations, which is how real penalties reach into the millions. Knowing or willful disclosure of PHI can also bring separate criminal charges, including imprisonment. A practice found non-compliant can face real operational consequences too, up to losing its ability to bill certain insurers -- which threatens the practice's survival, and by extension, our contract with them.

California adds its own, stricter law on top of this: the CMIA (Confidentiality of Medical Information Act) applies to every practice we support, requires breach notification within 15 business days -- far shorter than HIPAA's 60-day federal clock -- and carries its own separate penalties of up to $25,000 per affected patient for a first violation. CMIA also lets patients sue directly, which HIPAA alone does not allow. See "Suspected Breach or Incident" below for what this means in practice.

A second California law also applies more broadly, beyond just patient medical records: Civil Code §1798.82 covers any breach of personal information -- Social Security numbers, driver's license numbers, financial account details, or login credentials paired with a password -- with a 30-calendar-day notification window (recently tightened, effective January 2026), and a requirement to notify the California Attorney General if 500+ residents are affected. This is the law that would apply to something like a breach of employee payroll data or the portal's own Credentials page, not just patient charts.