Roseland Community Hospital Association Settles Data Breach Lawsuit for $650,000
Roseland Community Hospital Association in Illinois has agreed to settle a class action data breach lawsuit for $650,000. The lawsuit was filed in response to a 2024 cybersecurity incident that exposed sensitive patient and employee information. The attack was detected on June 2, 2024, and the investigation determined that names, dates of birth, addresses, medical record numbers, patient account numbers, health insurance information, diagnoses, and treatment information were present in the exposed data.
The data breach was reported to the HHS’ Office for Civil Rights using an estimate of at least 500 affected individuals, as required by the HIPAA Breach Notification Rule; however, that total has not been updated since the initial report, even though the data breach was far more extensive. According to court documents, the personal and protected health information of 101,354 individuals was potentially compromised in the incident. The affected individuals started to be notified on August 1, 2024.
On November 25, 2024, a class action lawsuit was filed by plaintiff Steven Hall in the Circuit Court of Cook County, Illinois, individually and on behalf of his three minor children. The lawsuit was consolidated with two further complaints as they had overlapping claims and classes. The plaintiffs alleged that the defendant was at fault, as reasonable cybersecurity measures had not been implemented as required by HIPAA, including but not limited to data encryption and logging, monitoring, and alerting tools. The lawsuit asserted claims for negligence, negligence per se, breach of implied contract, unjust enrichment, breach of bailment, invasion of privacy/disclosure of private information, and violation of the Illinois Consumer Fraud and Deceptive Business Practices Act.
The defendant maintains there was no wrongdoing and filed a motion to dismiss, which was granted in part and denied in part. The consolidated lawsuit – Hall, et al. v. Roseland Community Hospital Association – is pending in the Circuit Court of Cook County, Illinois. The parties engaged in settlement discussions and negotiated a settlement to avoid the costs and risks associated with protracted litigation. The settlement has recently received preliminary approval from the court.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Under the terms of the settlement, Roseland Community Hospital Association has agreed to pay $650,000 to settle the lawsuit, inclusive of attorneys’ fees and expenses, settlement administration and notice costs, service awards for the class representatives, and benefits for the class members. Class members may claim one year of medical data monitoring services, reimbursement of documented losses due to the data breach up to a maximum of $5,000 per class member, and a pro rata cash payment, estimated to be $50 per class member. The cash payments are subject to a pro rata adjustment based on the number of claims received.
The deadline for objection and opting out is December 1, 2026. Claims must be submitted by December 31, 2026, and the final fairness hearing has been scheduled for January 6, 2027.
