PHI of 33,420 BJC Healthcare Patients Exposed on Internet for 8 Months
The protected health information of 33,420 patients of BJC Healthcare has been accessible on the Internet for eight months without any need for authentication to view the information.
BJC Healthcare is one of the largest not-for profit healthcare systems in the United States. The St. Louis-based healthcare organization runs two nationally recognized hospitals in Missouri – Barnes-Jewish Hospital and St. Louis Children’s Hospital along with 13 others. The health system employs more than 31,000 individuals, has over 154,000 hospital admissions and performs more than 175,000 home health visits a year.
On January 23, 2018, BJC Healthcare performed a security scan which revealed one of its servers had been misconfigured which allowed sensitive information to be accessed without authentication. Action was immediately taken to reconfigure and secure the server to prevent data from being accessed.
The investigation revealed an error had been made configuring the server on May 9, 2017, leaving documents and copies of identification documents accessible. Highly sensitive information such as Social Security numbers, insurance cards, and driver’s license numbers were exposed along with patients’ names, addresses, contact telephone numbers, dates of birth, and treatment related information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The scanned documents stored on the server contained information collected from patients between 2003 and 2009. Patients who visited BJC Healthcare facilities after 2009 were not impacted by the breach.
The investigation did not uncover evidence to suggest any of the documents were accessed by unauthorized individuals, although data access could not be ruled out with a high degree of certainty. Therefore, out of an abundance of caution, all patients whose protected health information was exposed have been offered identity theft protection services without charge for 12 months.
The security incident has prompted BJC Healthcare to review its information system policies and processes, which have been updated to prevent any further incidents of this nature from occurring.
