HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

PHI of 33,420 BJC Healthcare Patients Exposed on Internet for 8 Months

The protected health information of 33,420 patients of BJC Healthcare has been accessible on the Internet for eight months without any need for authentication to view the information.

BJC Healthcare is one of the largest not-for profit healthcare systems in the United States. The St. Louis-based healthcare organization runs two nationally recognized hospitals in Missouri – Barnes-Jewish Hospital and St. Louis Children’s Hospital along with 13 others. The health system employs more than 31,000 individuals, has over 154,000 hospital admissions and performs more than 175,000 home health visits a year.

On January 23, 2018, BJC Healthcare performed a security scan which revealed one of its servers had been misconfigured which allowed sensitive information to be accessed without authentication. Action was immediately taken to reconfigure and secure the server to prevent data from being accessed.

The investigation revealed an error had been made configuring the server on May 9, 2017, leaving documents and copies of identification documents accessible. Highly sensitive information such as Social Security numbers, insurance cards, and driver’s license numbers were exposed along with patients’ names, addresses, contact telephone numbers, dates of birth, and treatment related information.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The scanned documents stored on the server contained information collected from patients between 2003 and 2009. Patients who visited BJC Healthcare facilities after 2009 were not impacted by the breach.

The investigation did not uncover evidence to suggest any of the documents were accessed by unauthorized individuals, although data access could not be ruled out with a high degree of certainty. Therefore, out of an abundance of caution, all patients whose protected health information was exposed have been offered identity theft protection services without charge for 12 months.

The security incident has prompted BJC Healthcare to review its information system policies and processes, which have been updated to prevent any further incidents of this nature from occurring.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.