The settlement is over a 2014 data breach that affected approximately 6.1 million patients in 28 states.
Twenty-eight states have won a multi-million-dollar judgement against Tennessee-based CHS/Community Health Systems Inc. and its subsidiary, CHSPSC LLC, over a 2014 data breach that affected approximately 6.1 million patients.
Last week it was announced that CHS/CHSI will pay nearly $5 million to Alaska, Arkansas, Connecticut, Florida, Illinois, Indiana, Iowa, Kentucky, Louisiana, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, Nevada, New Jersey, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Washington and West Virginia.
The data breach exposed patients’ names, birthdates, social security numbers, phone numbers and addresses.
The company also agrees to:
- Implement and maintain a comprehensive information security program to safeguard personal information and protected health information (PHI).
- Develop a written incident response plan.
- Incorporate security awareness and privacy training for all personnel who have access to PHI.