Community Health Systems has reached a settlement in a class action over a 2014 data breach that affected 4.5 million patients, The Nashville Post reports. It has been ranked one of the largest health care data breaches in history.
The cyberattack took place in April and June of 2014, according to court records, and was orchestrated by a Chinese criminal group that stole patients' names, addresses, birth dates and Social Security numbers from CHS’ electronic health records system. Although the attack was premeditated, 16 former CHS patients allege the Franklin-based company's leaders made no effort to patch their software system after the breach was discovered. The Post reported in 2015 that the company also kept patient data on a test server, which left patient data extremely vulnerable. CHS denies all claims and says it did nothing wrong.
The settlement agreement, which is pending approval by a judge on Aug. 13, makes CHS responsible for two types of compensation for patients affected. Each patient is entitled to up to $250 to cover identity theft protection services and personal time taken to deal with matters relating to the breach, and up to $5,000 for patients who experienced identity theft or fraud due to the breach. Affected patients may submit a claim form by Aug. 1 to be included in the settlement here.
Also under the settlement agreement, the total amount of claims paid is capped at $3.1 million. If valid claims are submitted for more than that amount, claims will be distributed on a pro-rata basis.
It has been quite the year for CHS in various court rooms. The hospital systems owner has faced a federal investigation surrounding its EHR work, was denied millions from Quorum Health — which it spun off in 2016 — by an arbitration panel, is currently in a legal battle with Dallas-based Steward Health following an acquisition agreement gone wrong and was sued last year by global tech giant Microsoft for alleged copyright infringement, although the tech giant last fall withdrew its complaint.
Shares for CHS (Ticker: CYH) were down 1.4 percent midday Tuesday and are up slightly over the past six months. At the end of its September quarter, the company has $335 million in cash on hand, compared to the $563 million the year prior.
