In order to settle a lawsuit filed against it by patients who were victims of a data breach in 2019, the American healthcare provider Kalispell Healthcare has proposed a settlement of $4.2 million.
Kalispell Regional Healthcare, based in Montana, announced in October last year that it had suffered a data breach. The personal health information of about 130,000 patients was exposed as a result of the attack .
As Kalispell CEO and president Craig Lambrecht said at the time , criminals used a “sophisticated phishing attack” to gain access to the email accounts of several company employees on May 24, 2019. The breach was not detected by the healthcare provider until August of that year.
The data that was breached included names, addresses, phone numbers, dates of birth, medical record numbers, medical history, social security numbers, and health insurance information.
Attackers stole approximately 250 Social Security numbers from Kalispell Regional patients. After the breach was announced, the healthcare provider advised patients to review their accounts, report any suspicious activity to authorities and, if necessary, freeze their credit cards.
The lawsuit filed against Kalispell alleges that it failed to take appropriate steps to ensure the confidentiality of its patients' data, thereby putting them at risk, while waiting until October to disclose the fact.
It also claims that employees were not given adequate training on security and that Kalispell did not do enough to monitor its systems for suspicious activity.
The case is scheduled to go before Judge Elizabeth Best for a final approval hearing on Jan. 5. Kalispell Regional denies any wrongdoing on its part in the settlement document. The health care provider proposes to create a $4.2 million settlement fund that will be used to pay various relief benefits to victims of the data breach.
