A community hospital association on Chicago’s South Side has agreed to pay $650,000 to close a class action over a 2024 intrusion that exposed the records of roughly 101,000 people.
An attack on Roseland Community Hospital Association was detected on June 2, 2024. The review found names, dates of birth, addresses, medical record numbers, patient account numbers, health insurance details, diagnoses and treatment information in the affected data. Patients began receiving notices on August 1, 2024.
The filing with the HHS Office for Civil Rights used the minimum estimate of at least 500 individuals and was never updated, even though court documents put the true figure near 101,354. That gap between the regulatory placeholder and the real count is a recurring problem in healthcare breach reporting.
The suit, brought by Steven Hall and consolidated with two other complaints, alleged the hospital failed to implement reasonable safeguards such as encryption and logging, monitoring and alerting tools. The hospital denied wrongdoing and won a partial dismissal before the parties negotiated a settlement that has now received preliminary approval in Cook County Circuit Court.
For compliance teams, the case underscores two lessons: the OCR placeholder figure can understate exposure by orders of magnitude, and plaintiffs’ attorneys treat missing encryption and monitoring as central allegations. Community hospitals running lean IT budgets should prioritise logging and detection coverage, which are cheap relative to the cost of litigation.
