Photo: Shutterstock.com

A large provider of products and services to people with chronic and acute kidney disease has agreed to pay $3.5 million to the federal government after five separate low-tech data breaches in 2012, the U.S. Department of Health and Human Services has announced.

In addition to the monetary settlement, Fresenius Medical Care North America agreed to adopt a comprehensive corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act Privacy and Security rules that were identified by HHS's Office for Civil Rights.

Fresenius is a German-based company with a North American unit that serves more than 170,000 patients in the United States through a network of dialysis facilities and outpatient lab.