South Carolina Attorney General Alan Wilson, along with the attorneys general of 27 other states, has obtained a judgment against Tennessee-based CHS/Community Health Systems, Inc., and its subsidiary, CHSPSC LLC. This judgment resolves an investigation of a data breach that impacted approximately 6.1 million patients, including 400,903 from the state of South Carolina.
At the time of the data breach, CHS owned, leased, or operated 206 affiliated hospitals nationwide. Exposed in the breach were the names, birthdates, social security numbers, phone numbers, and addresses of patients. The judgment, agreed to by CHS, requires a $5 million payment to the States and provides that CHS agrees to implement and maintain a comprehensive information security program reasonably designed to safeguard Personal Information (PI) and Protected Health Information (PHI), which will include specific information security requirements.
“Privacy data breaches have been on the rise for years now, and we are challenged with balancing business interests as well as those of our South Carolina consumers,” Attorney General Wilson said. “Our Office feels this is a fair settlement with procedures put in place to hopefully deter, or at least minimize, future data breach incidences that impact our state.”
Specific information security measures contained in the agreed judgment include the requirements to develop a written incident response plan; to incorporate security awareness and privacy training for all personnel who have access to PHI; to limit unnecessary or inappropriate access to PHI and to implement specific policies and procedures regarding business associates, including use of business associate agreements and audits of business associates.
Other states participating in this settlement include Alaska, Arkansas, Connecticut, Florida, Illinois, Indiana, Iowa, Kentucky, Louisiana, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, Nevada, New Jersey, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, Tennessee, Texas, Utah, Vermont, Washington, and West Virginia.