Arizona-based Banner Health has agreed to settle for up to $6 million a class action case filed against it following a 2016 incident that compromised the personal information of 3 million individuals. The breach compromised data on two information technology systems at the health system, including patient information and health insurance information on one system, and credit card information of individuals who purchased food and beverages at the hospital system on a second system.

According to a Motion for Preliminary Approval of a Settlement filed recently, Banner Health has agreed to pay up to a cap of $6 million to individuals who request reimbursement claims for expenses incurred as a result of the incident, including out-of-pocket expenses or time lost from identity theft or fraud.

Banner Health also has agreed to provide affected individuals with two years of credit monitoring and identity protection services, and to improve its information security systems.