The Circuit Court of Cook County recently granted preliminary approval of a proposed settlement agreement that requires Lurie Children’s Hospital of Chicago, the largest pediatric care provider in the Chicago region, to implement new security measures to resolve a class-action dispute stemming from a data breach.^[1]

The settlement arises from a lawsuit stemming from two incidents in which employees improperly accessed patient data without valid, work-related reasons. The first incident occurred from September 2018 to September 2019; it affected a reported 4,195 individuals, and the second incident occurred from November 2018 to February 2020 and affected a reported 4,824.^[2] Lurie Children’s provided patients with notice of the first incident in December 2019 and of the second incident in May 2020. The lawsuit alleges breach of contract, breach of implied contract, unjust enrichment, breach of duty of confidentiality, intrusion upon seclusion, and negligent supervision of staff.