January 31, 2023

Volume XIII, Number 31


January 30, 2023

Subscribe to Latest Legal News and Analysis

Community Health Systems Enters Into Five-Million-Dollar, Multi-State Settlement Agreement in Connection with 2014 Data Breach

On October 8, 2020, Community Health Systems, Inc. (Community Health) and its subsidiary CHSPSC, LLC entered into a settlement agreement with 28 states for $5 million to resolve claims related to a 2014 data breach. Community Health owns over 200 hospitals across the United States and is one of the largest hospital networks in the country. The multi-state settlement follows a separate $2.3 million settlement that Community Health reached with the U.S. Department of Health and Human Services Office for Civil Rights (HHS-OCR) in connection with the same data breach.

In August 2014, Community Health disclosed that cyber attackers had gained access to its networks earlier that year and had obtained personal information for approximately 4.5 million patients. Subsequent investigation revealed the total number of affected patients to be more than six million. The attackers gained access to, among other things, patients’ names, addresses, birth dates and social security numbers.

Twenty-eight states were involved in the settlement, including, among others, Illinois, New Jersey and Massachusetts. The amount each state will receive as part of the settlement varies based on the number of residents affected by the data breach. In addition, as part of the settlement, Community Health must undertake additional measures to ensure the protection of sensitive patient information, including, among other things, drafting a written incident response plan, providing additional security and privacy training for employees, and taking steps to limit individual employees’ access to data in the company’s systems.

The settlement with Community Health is the latest financially-significant, multi-state settlement in connection with a large data breach. Since just the beginning of September 2020, publicly-announced, multi-state data breach settlements have resulted in fines and penalties of approximately $45 million. These large – and public – penalties are a reminder of the emphasis being placed on data privacy and data breach enforcement by both the federal government and individual state attorneys general and regulators. With the passage or impending passage of new and onerous data privacy and data breach statutes by individual states, companies should expect that this aggressive and punitive enforcement mindset will continue for the foreseeable future.

© 2023 Faegre Drinker Biddle & Reath LLP. All Rights Reserved.National Law Review, Volume X, Number 290

About this Author

Peter Baldwin, Securities lawyer, Drinker Biddle

Peter W. Baldwin, a former federal prosecutor, defends clients facing white-collar criminal and internal investigations, securities enforcement actions, cybersecurity issues, and other complex civil and criminal litigation matters. Prior to joining Drinker Biddle, Pete spent over eight years as an Assistant United States Attorney in the U.S. Attorney’s Offices for the Eastern District of New York and Central District of California. In this role, he supervised all aspects of criminal investigation and prosecution, first as a member of the Major Frauds Section in the Central...

(212) 248-3147
Lucas Michelen, corporate lawyer, Drinker Biddle

Lucas B. Michelen represents a variety of corporate clients involved in complex commercial litigation. Lucas has experience representing clients in litigation related to business tort and commercial contract disputes, white collar criminal defense, and state Attorney General consumer protection actions. Lucas also defends pharmaceutical and medical device companies in mass tort cases in both state and federal court.

Lucas maintains an active pro bono practice and has worked on cases with multiple public interest organizations, including the Public...

(215) 988-2489