Three Key Takeaways From The NY DFS HealthPlex Settlement

On August 14, 2025, the NY Department of Financial Services (NY DFS) entered into a consent order with Healthplex, LLC, fining the insurance agent and adjuster $2 million for alleged violations of the NY DFS Part 500 Cybersecurity Regulation.

Key Allegations

NYDFS alleged that Healthplex:

• Did not maintain a data retention and disposal policy for sensitive nonpublic information (NPI) in its Microsoft Office 365 (Office 365) environment, in violation of 23 NYCRR § 500.13. The compromised mailbox contained more than 100,000 emails with sensitive personal and health information affecting tens of thousands of consumers.
• Failed to implement multi-factor authentication for Office 365 web access following a 2021 migration, in violation of 23 NYCRR § 500.12(b). This allegedly allowed a phishing attack to compromise the employee's email account.