Kalispell Regional Healthcare has agreed to pay $4.2 million in a settlement with patients affected by a 2019 data breach of medical records. The settlement could assist up to roughly 130,000 people who had their personal information stolen.
In the spring of 2019, hackers gained access to names, phone numbers and addresses of thousands of KRH patients. KRH says about 250 patients' social security numbers were also stolen in the breach.
The class-action lawsuit filed in Cascade County District Court last year alleged that the hospital didn’t do enough to prevent the phishing scheme that gave hackers access to that information or notify those impacted soon enough.
According to the settlement reached in late October, KRH will set aside $4.2 million to reimburse plaintiffs for out-of-pocket expenses and time spent fixing issues related to the breach. The settlement will also pay for identity restoration and credit monitoring services. A website has been set up so those impacted can easily file claims.
KRH spokesperson Mellody Sharpton says the settlement has been agreed to and will be finalized by the court in early January. In an emailed statement, Sharpton added that settlements in these kinds of cases are common and quote “we will work with the court through the settlement process,” end quote.
As part of the settlement, KRH also agreed to beef up its cybersecurity and educational programs for employees.
None of the three law firms representing plaintiffs in the case returned calls for comment by deadline.
