A law firm that represents New York City-area hospitals will pay the state $200,000 in penalties for failing to protect patients’ personal and health care data, Attorney General Letitia James said Monday.

Heidell, Pittoni, Murphy & Bach’s “poor data security measures” made it vulnerable to a 2021 data breach that compromised the private information of approximately 114,000 patients, including more than 60,000 New Yorkers, James said in a statement.