The Cost of Not Having a Plan: Fines and Enforcement Actions Law Firms Now Face

Most conversations about law firm continuity planning stay in ethics-rule language: competence, diligence, reasonable efforts. That framing is accurate, but it understates something firms handling regulated data need to know. Several federal and state enforcement regimes attach actual dollar penalties to the specific absence of a contingency, risk-assessment, or incident response plan — and the organizations that have paid those penalties offer a clear picture of what regulators expect to find.

HIPAA: Fined for the Missing Plan, Not Just the Breach

Law firms that receive protected health information in healthcare-related matters — medical malpractice defense, healthcare transactions, employment cases involving medical records — can qualify as HIPAA Business Associates. That status brings Security Rule obligations, including a contingency planning standard that explicitly requires a data backup plan, an emergency mode operations plan, and a disaster recovery plan.¹ When the Department of Health and Human Services' Office for Civil Rights (OCR) investigates a breach, it doesn't just ask what happened — it asks whether a contingency plan existed before the incident.

Case in Point: Heritage Valley Health System

In 2017, Heritage Valley — a Pennsylvania-based health system — was hit by malware related to the NotPetya outbreak, which prevented access to its Windows-based devices. OCR's investigation found three areas of Security Rule non-compliance: no comprehensive risk analysis had been conducted, there was no contingency plan for responding to the emergency, and technical safeguards were inadequate.²

• $950K — Settlement paid to OCR
• 2017 — Year of the incident
• 3 yrs — Corrective action monitoring

Heritage Valley isn't a law firm, but the standard that produced this penalty is identical to the one that applies to any law firm acting as a Business Associate. The absence of a contingency plan was named explicitly as a basis for the fine — not the malware infection itself.

This isn't an isolated case. In one recent enforcement sweep, OCR fined four separate organizations a combined $1.7 million for ransomware-related breaches traced back to the same root cause: risk analyses that were never properly conducted.³ The pattern OCR has been explicit about is consistent — proactively implementing the Security Rule before a breach is both the legal requirement and an organization's best chance of limiting the damage when an attack happens anyway.

The FTC Safeguards Rule: A Per-Day Penalty Structure

Law firms qualifying as "financial institutions" under the Gramm-Leach-Bliley Act — most commonly firms handling real estate closings, mortgage transactions, or certain lending and investment matters — fall under the FTC's Safeguards Rule. The rule requires a written information security program with nine specific elements, including a written incident response plan covering what the firm calls a "security event."⁴ Civil penalties for violations of the underlying FTC Act can run into the tens of thousands of dollars per violation, per day — a structure that turns a prolonged compliance gap into a compounding liability rather than a one-time fine.

Worth knowing: firms with fewer than 5,000 consumer records are exempt from some Safeguards Rule requirements — including the formal written risk assessment and incident response plan — but not from the underlying rule itself. Every covered firm, regardless of size, must maintain a written security program.

State Breach Notification Laws and the Civil Litigation Layer

All fifty states have data breach notification statutes, and a number of them carry explicit civil penalty provisions for untimely notification — separate from any private lawsuit a breach might also trigger. For law firms, this creates a compounding exposure: a delayed or absent incident response plan doesn't just slow the response, it directly increases the odds of missing a state's notification deadline, which is often the specific trigger for a penalty.

The civil litigation layer is its own consequence, even without a regulator involved. In 2025, a class action was filed against the law firm Wong Fleming alleging negligent cybersecurity practices that allowed unauthorized access to sensitive personal data, including Social Security numbers and medical records, compounded by delayed breach notification.⁵ That case is a lawsuit, not a government fine — its outcome was still pending as of this writing — but it illustrates the same exposure from a different direction: the plan's absence becomes the allegation itself.

What This Means in Practice

The throughline across HIPAA, the FTC Safeguards Rule, and state breach laws isn't the type of incident — it's whether a plan existed beforehand. Regulators consistently distinguish between an organization that had a tested contingency plan and experienced an incident anyway, and one that had nothing in place. The first scenario shapes the size of the penalty. The second one becomes the penalty's primary justification.

Minimum Documentation Regulators Look For

• A written risk analysis or assessment, dated and periodically updated
• A documented contingency or disaster recovery plan covering data backup and emergency operations
• A written incident response plan with a defined notification process and timeline
• Evidence the plan has been tested, not just drafted
• Records showing leadership reviewed and approved the program, with dates

None of this requires guessing at what regulators want. The documentation expectations are published, consistent across enforcement actions, and — as the cases above show — the absence of that documentation is treated as its own finding, separate from whatever incident triggered the investigation in the first place.

Footnotes

1. 45 CFR § 164.308, HIPAA Security Rule. ↩

2. HHS Office for Civil Rights, Heritage Valley Health System Resolution Agreement. ↩

3. HHS Office for Civil Rights, April 2026 enforcement announcement. ↩

4. 16 CFR Part 314, FTC Safeguards Rule. ↩

5. Ragoonath v. Wong Fleming, filed 2025. ↩