Kalispell Regional Healthcare is facing a potential class action lawsuit over a data breach of personal information impacting up to 130,000 people. The hospital announced the incident in October, two months after it discovered the breach. The lawsuit filed late last month argues victims are at increased risk of identity theft.
Billings-based law firm Heenan & Cook is representing William Henderson, one of the roughly 130,000 KRH patients whose personal information may have been exposed in the data breach.
The exposed data includes names, phone numbers and medical information. Kalispell Regional Healthcare says 250 patients had their social security numbers exposed, but all of the data could have been accessed as early as May of this year. KRH says it didn’t discover the breach until August. It announced the incident in October, saying that it took that time to clearly identify which patients may have been affected.
The lawsuit filed in Cascade County District Court late last month argues that delay put potential victims at increased risk of identity theft and that the hospital could have let a majority of its patients know sooner in order to allow them to put freezes on their credit and monitor personal accounts closely. The complaint also alleges that KRH didn’t take proper precautionary measures to prevent the breach in the first place.
KRH spokesperson Mellody Sharpton says the hospital has not been served any court documents related to the case and declined to comment on specific allegations.
“We are however disappointed about the lawsuit. We value our relationship with our patients and take safeguarding their privacy very seriously,” she says.
The complaint is asking the court to certify the case as a class action lawsuit and is seeking monetary compensation for those affected by the breach.