HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Feb. 26, 2016.
- Organization as reported
- BJC HealthCare ACO, LLC, MO
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Feb. 26, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14611, row:5750)
- Archived copy
- Held in the private archive (provenance)
On December 22, 2015, an employee sent an unencrypted email to a third party, in violation of the covered entity's (CE) policies. The breach involved the protected health information (PHI) of approximately 2,393 individuals and included patients’ names, birthdates, Medicare health insurance numbers, and genders. The CE, BJC HealthCare ACO, LLC, provided breach notification to HHS, affected individuals, and the media and posted substitute notification on its website. The CE also contacted the recipient of the email to report that the email was sent out without encryption and contacted all private physician participants to test their computer servers for transport layer security (TLS). The CE provided mandatory training to all its workforce members and additionally trained the employee responsible for the incident on secure email. OCR obtained documentation which showed that the CE implemented the corrective actions listed.