Email Accounts Compromised at BJC HealthCare & Cooper University Health Care
BJC HealthCare, a non-profit healthcare organization based in St. Louis, MO, has started notifying certain patients that some of their protected health information was stored in email accounts that were accessed by an unauthorized individual.
The investigation confirmed that a small number of email accounts of physicians and general practitioners had been accessed between March 4 and March 28, 2022. The forensic investigation did not determine whether emails and attachments had been viewed or copied, but unauthorized data access and theft could not be ruled out.
A comprehensive review of the email accounts confirmed they contained names, dates of birth, medical record numbers, and clinical information such as performance dates, diagnoses, provider names, and/or treatment locations. A limited number of patients also had their health insurance information, driver’s license numbers, and/or Social Security numbers exposed.
Individuals who had either their driver’s license number or Social Security number exposed can take advantage of the complimentary credit monitoring and identity theft protection services that have been offered.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.
Email Incident Reported by Cooper University Health Care
Camden, NJ-based Cooper University Health Care announced on May 25, 2022, that the email account of an employee was accessed by an unauthorized individual on November 24, 2021. The security incident was detected on December 13, 2021, and the investigation concluded on May 10, 2022.
The email account contained information such as names, dates of birth, medical professional names, diagnosis and treatment information, billing and claims information, and medical record numbers. No evidence of actual or attempted misuse of patient data has been identified at the time of issuing notification letters.
The HHS’ Office for Civil Rights breach portal indicates 1,039 individuals were affected.
