Press Release  AG Healey Secures Judgment Resolving Data Breach Investigation at National Hospital System

Boston — A Tennessee-based national hospital system will pay $5 million to settle a multistate investigation involving 27 state attorneys general into a data breach at the company that impacted more than 6.1 million patients across the country, including 8,000 in Massachusetts, Attorney General Maura Healey announced today. Massachusetts will receive nearly $40,000 as part of the settlement. 

In a proposed consent judgment filed in Suffolk Superior Court today that is subject to court approval, Community Health Systems Inc. (CHS) and its subsidiary CHSPSC LLC also agreed to significantly change their business practices after the data breach exposed the names, birthdates, social security numbers, phone numbers, and addresses millions of patients nationwide.  

“Hospitals need to protect their patients’ private information,” said AG Healey. “This settlement requires CHS to implement a new information security program and train its staff on how to properly handle the private information of those they serve.”

With today’s settlement, CHS has agreed to make significant business practice changes and to implement several improvements to its security processes, including: 

• Developing a written incident response plan.
• Incorporating security awareness and privacy training for all personnel who have access to the personal health information of patients.
• Limiting unnecessary or inappropriate access to personal health information
• Implementing specific policies and procedures regarding business associates, including use of business associate agreements and audits of business associates.

Joining AG Healey in today’s settlement include Alaska, Arkansas, Connecticut, Florida, Illinois, Indiana, Iowa, Kentucky, Louisiana, Michigan, Mississippi, Missouri, Nebraska, Nevada, New Jersey, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Washington, and West Virginia.

This matter was handled by Assistant Attorney General Michael Wong of the AG’s Health Care Division.

###