Roseland Community Hospital Association has decided to settle a class action lawsuit for $650,000 concerning a June 2, 2024 data incident that likely compromised the personal and protected health information (PHI) of patients and other people, with final court approval still pending.
Roseland Community Hospital Association in Illinois detected the incident on June 2, 2024. The investigation determined that the exposed data included personal and health-related information, such as names, birth dates, addresses, patient account numbers, medical insurance data, medical record numbers, diagnoses, and treatment details.
Based on court documents referred to in the reporting, the incident possibly exposed information belonging to 101,354 people. The breach report was submitted to the U.S. Department of Health and Human Services Office for Civil Rights with an estimate of about 500 affected individuals. The reported total was not yet updated from the preliminary report, in spite of the bigger number of potentially impacted individuals determined in the court documents. Breach notification letters were sent to affected individuals beginning on August 1, 2024.
The settlement website confirms that the incident potentially impacted patients’ personally identifiable information (PII) and PHI. The settlement class includes those whose data was likely breached and who received a notification letter from Roseland Community Hospital Association.
Class Action Lawsuit and Settlement Terms
Steven Hall submitted a class action lawsuit on November 25, 2024, in the Circuit Court of Cook County, Illinois, separately and representing his three small kids. Two more complaints were combined with the lawsuit since they shared similar claims and classes. The case is Hall, et al. v. Roseland Community Hospital Association, Case No. 2024CH10367.
The plaintiffs claimed that Roseland Community Hospital Association did not apply proper cybersecurity measures, such as monitoring, HIPAA encryption, logging, and alerting apps. The lawsuit stated claims including invasion of privacy or disclosure of private data, negligence, negligence per se, unjust enrichment, breach of bailment, breach of implied contract, and violations of the Illinois Consumer Fraud and Deceptive Business Practices Act.
Roseland Community Hospital Association rejects the accusations, and any liability, or wrongdoing. The defendant filed a motion to dismiss, which the court approved partly and denied partly. The parties eventually discussed a settlement to resolve the lawsuit.
The proposed settlement will create a $650,000 settlement fund that will pay for class member benefits, attorneys’ fees and expenditures, settlement management fees, and class representatives’ service awards.
Settlement Benefits and Claim Requirements
Qualified class members could claim a year of healthcare records monitoring services, refund for documented losses related to the data incident as high as $5,000 for each class member, and a pro rata cash payment presently estimated at $50. The final cash payment could be adjusted proportionally according to the number of valid claims filed.
Class members need to submit a valid and prompt claim form online or by mail to get settlement benefits. The last day to submit claim forms is December 31, 2026. December 1, 2026 is the deadline for filing objections and requests to opt out of the settlement. The final approval hearing is on January 6, 2027, although the date is subject to change.
People who opt out will not receive settlement benefits yet keep the right to sue the defendant and the released parties regarding the claims completed by the settlement. Those who do nothing and do not opt out will not get settlement benefits and will forfeit the right to sue the defendant and the released parties regading the claims resolved by the settlement.
Image credits: Tromistudio 1619904819 AdobeStock / logo©RoselandCommunityHospital
