 The use of electronic technology has been described as a boon for health care delivery and administration for decades (Burton 2004; National Research Council 1991). Yet heightened concerns for privacy followed increased portability of health data mandated by law (HIPAA 1996) and third-party (“cloud”) data storage. The obligation to protect medical data held by the state or private companies has taken on a new urgency as more and more health data is being transmitted and stored electronically. It has been argued that information managers owe it to the public to take stringent measures to prevent data breaches and to appropriately respond and remediate when a breach occurs. A data breach can result from the theft of a laptop; fraudulent or accidental access to data; sabotage by dishonest or disgruntled employees; or the loss of data storage devices. Major hospitals, health agencies and insurers have experienced highly publicized data breaches affecting millions of consumers whose names, addresses, health identification numbers and other data were compromised (Seh et al. 2020). A philosophical question raised by data breaches is how to define and morally repair harm. Medical identity theft and public disclosure of private facts are generally regarded as “harms” (Biegelman 2009). But it has been argued that negligently causing increased risks of identity theft and public disclosure of private facts are harms, too. If risk amplification is harm, though, it is unclear what should count as fair compensation or moral repair. 