Nevada AG Ford joins 28 state settlement resolving Community Health Systems data breachChristian Fernsby ▼ | October 13, 2020
Nevada Attorney General Aaron D. Ford announced that he, along with the Attorneys General of 27 other States, has obtained a judgment against Tennessee based CHS Community Health Systems, Inc., and its subsidiary, CHSPSC LLC.
Nevada Attorney General Aaron D. Ford
At the time of the data breach, CHS owned, leased, or operated 206 affiliated hospitals including the Mesa View Regional Hospital in Mesquite, Nevada. Nevada consumers may have also visited out-of-state clinics that were impacted by the breach. Exposed in the breach were the names, birthdates, Social Security numbers, phone numbers and addresses of patients.
The judgment, agreed to by CHS, requires a $5 million payment to the States and provides that CHS agrees to implement and maintain a comprehensive information security program reasonably designed to safeguard Personal Information and Protected Health Information (PHI), which will include specific information security requirements. Nevada will receive $51,096.64 from the settlement.
Specific information security measures contained in the agreed judgment include the requirements to develop a written incident response plan; to incorporate security awareness and privacy training for all personnel who have access to PHI; to limit unnecessary or inappropriate access to PHI and to implement specific policies and procedures regarding business associates, including use of business associate agreements and audits of business associates.
Other states participating in this settlement include Alaska, Arkansas, Connecticut, Florida, Illinois, Indiana, Iowa, Kentucky, Louisiana, Massachusetts, Michigan, Mississippi, Missouri, Nebraska, New Jersey, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, Tennessee, Texas, Utah, Vermont, Washington, and West Virginia. ■