Hospital Chain to Pay $7.6M to Settle Breach Litigation

A network of 13 Catholic hospitals, community health centers and clinics in the Midwest has agreed to pay $7.6 million and implement improvements to its data security practices to settle consolidated class action litigation filed in the aftermath of a 2023 hacking incident affecting nearly 900,000 people.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The litigation centers on a “targeted cyberattack” in August 2023 against Springfield, Illinois-based Hospital Sisters Health System that compromised personally identifiable information and protected health information of 882,782 people (see: Catholic Hospital Chain’s 2023 Hack Affected Nearly 900,000).

Under the settlement, HSHS will pay up to $5,000 to each eligible class member who submits a valid claim by Nov. 14 with supporting documentation for out-of-pocket losses “demonstrably” tied to the August 2023 hacking incident.

As an alternative, class members may instead choose a pro-rated cash payment. That amount will be calculated based on the balance remaining in the settlement fund after payment claims for out-of-pocket losses and also costs involving the 24-months of complimentary credit and identity monitoring services, which are also being offered to class members.

HSHS also has agreed under the settlement to implement “remedial measures” to enhance its data security and privacy controls and policies. Court documents do not detail the specific improvements HSHS plans to make.

HSHS denies all wrongdoing, liability and claims in the consolidated litigation.

The consolidated lawsuit, among other allegations, accused HSHS of negligence, unjust enrichment and breach of contract, related to the data breach of patients’ sensitive information.

Attorneys’ fees and expenses are slated to not exceed 35% of the settlement fund, or about $2.6 million. A final hearing for the settlement is scheduled for Dec. 4 in the Chancery Court of Sangamon County, Illinois.

Legal experts say the amount paid out to claimants will be purposefully small.

“HSHS will pay no more than $7.6 million, including plaintiffs’ attorneys’ fees. That leaves less than $5 million to compensate close to 900,000 people affected by the breach,” said attorney Paul Hales of the Hales Law Group, which is not involved in the HSHS litigation.

“The playbook of healthcare data breach defendants, such as HSHS, is well-established,” he said. “Their goal is to reach a quick settlement and pay minimal monetary damages to breach victims. HSHS employed the strategy effectively.”

Hales notes that on Jan. 8, 2025, an Illinois court consolidated several cases into the HSHS class action, “and within six months, it was settled,” he said.

“The playbook of healthcare data breach plaintiffs is also well-established,” he added. “It includes jockeying for position as class counsel and settling the case after winning pretrial motions that disarm the defendant.”

The efforts of private healthcare data breach plaintiffs have become a significant reminder to the healthcare industry that it must tighten its cybersecurity standards, he said.

Although data breach class members receive little compensation, defendants’ commitments to improve data security as part of settlements such as the HSHS case “benefits their patients going forward,” Hales said.

“The entire healthcare industry is now on notice. Embarrassing and costly class action lawsuits will follow data breaches.”

Breach Details

HSHS in its breach notice to affected individuals said that on Aug. 27, 2023, it discovered “an unauthorized third-party” had gained temporary access to HSHS’s network.

HSHS said it took immediate steps to contain and remediate the incident and launched an internal investigation, as well as reported the incident to law enforcement.

The forensic investigation determined that threat actors accessed certain files on HSHS’ network between Aug. 16 and Aug. 27, 2023. The compromised information varied for each individual, but potentially included names, addresses, date of birth, medical record numbers, limited treatment information, health insurance information, Social Security numbers and driver’s license numbers.

In the meantime, HSHS still faces other litigation in federal court unrelated to the data breach.

That includes a proposed class action lawsuit related to employment privacy that alleges HSHS is violating the Illinois Genetic Information Privacy Act by requiring potential employees to submit to a pre-employment medical examination during which the job candidates must disclose their family medical history as part of the hiring process.

HSHS also defended a proposed class action lawsuit filed in an Illinois federal court in December by plaintiffs alleging they are receiving unrelenting robocalls claiming to be from HSHS alleging the individuals owe money.

The plaintiffs in that case claimed HSHS had confirmed to each of them that they have no outstanding balances, and yet the calls continued. The complaint did not indicate whether the alleged automated calls were potentially tied to the HSHS’ hacking incident. That lawsuit was settled in April, but terms of the settlement were not disclosed.

HSHS in a statement to Information Security Media Group said it denies any wrongdoing related to the 2023 cyber incident.

“Individuals who may be part of the settlement class received a notice in the mail in September. HSHS remains focused on providing the highest quality patient care.”*

*Updated on Oct. 2 10:01 UTC to include HSHS’ statement.