ST. JOSEPH HEALTH SYSTEM

Saint Joseph Regional Medical Center, Inc. reported to HHS on 2020-05-28 a Improper Disposal affecting 1000 individuals. Breached information located on Paper/Films. A business associate improperly discarded documents containing PHI (names, SSNs, diagnoses, financial info). The CE notified HHS, individuals, media, and law enforcement, and destroyed the records.

St. Joseph Health (California) disclosed an error-based breach on February 18, 2014, where an employee inadvertently emailed an unencrypted Excel file containing patient names and health service details to an external investment firm (Cain Brothers). The breach was contained the same day upon recipient deletion. No SSNs or financial data were exposed. St. Joseph Health retrained staff and engaged Kroll for risk mitigation.

St. Joseph Health System notified California AG in 2014 regarding a December 2013 security attack where hackers gained unauthorized access to a server. The breach potentially exposed patient and employee names and addresses. The system was shut down on Dec 18, 2013. Forensic experts and the FBI were engaged. No misuse of information was reported. Identity protection services were offered.

St Joseph Health System reported to HHS on 2014-02-05 a Hacking/IT Incident affecting 405,000 individuals. Breached information located on Network Server. The server was hacked during a power surge, exposing ePHI including names, DOB, SSN, medical info, bank account info, and addresses. The CE provided breach notification to HHS, affected individuals, and the media, and improved administrative and technical security.

St. Joseph Health System (CA) reported to HHS OCR on 2012-02-15 an Unauthorized Access/Disclosure affecting 12,234 individuals (HHS portal count; OCR investigation found 31,800 individuals actually exposed). ePHI stored on a network server was publicly accessible via internet search engines (e.g. Google) from Feb 1, 2011 to Feb 13, 2012, due to default file-sharing application settings left unconfigured. Data exposed included patient names, health statuses, diagnoses, and demographics. SJH settled with OCR for $2,140,500 and agreed to a corrective action plan.