John Muir Health - Walnut Creek Medical Center

John Muir Health – Walnut Creek Medical Center (CA) reported to HHS OCR on 2023-04-13 an Unauthorized Access/Disclosure affecting 821 individuals. A workforce member posted a link to PHI on a publicly accessible website. PHI involved included names, diagnoses, and other treatment information stored on a Network Server. The CE sanctioned the workforce member, implemented additional safeguards, and retrained staff.

Affected (this filing): 821

John Muir Health - Walnut Creek Medical Center disclosed an incident where a staff member created a website linking to an Excel file containing patient health information (name, facility, room, diagnosis, dates) without proper access controls. The website was active from July 1, 2021, until it was decommissioned on March 24, 2023. The Privacy Office was notified on March 22, 2023. No financial information was involved. The organization disabled the link and decommissioned the site, and is re-educating staff and reviewing policies.