A Notice to Patients

BJC HealthCare (“BJC”) is committed to protecting the confidentiality and security of our patients’ information. Regrettably, this notice concerns a security incident that may have involved some of that information.

On March 29, 2022, we learned that email accounts belonging to a small number of BJC physicians and resident physicians were subject to unauthorized access. The investigation confirmed the unauthorized access occurred between March 4, 2022, and March 28, 2022, but was unable to determine whether any emails or attachments in the accounts were actually viewed by the unauthorized person. Out of an abundance of caution, we reviewed the emails and attachments contained in the accounts to identify what information may have been accessible to the unauthorized person. While this review is ongoing, BJC has identified emails and/or attachments in the accounts that contained some patients’ information, which may have included names, dates of birth, medical record numbers, and clinical information, such as dates of service, diagnoses, provider names, and/or treatment locations. In some instances, patients’ health insurance information and/or Social Security numbers may have also been contained in the accounts.

This incident did not affect all BJC or affiliated hospitals’ and service organizations’ patients, but only those patients whose information was included in the affected email accounts. The affiliated hospitals and service organizations that may be affected by this incident include:

On May 27, 2022, BJC began mailing letters to individuals whose information was identified thus far. Upon completion of its ongoing review, BJC will mail letters to additional patients whose information is identified in the email accounts and for whom BJC has sufficient contact information. BJC has also established a dedicated, toll-free call center to answer patients’ questions. If you have questions, please call 1-855-503-2933, Monday through Friday, from 8 a.m. to 5:30 p.m. Central Time. For those patients whose Social Security numbers and/or driver’s license numbers are identified in the email accounts, BJC will offer complimentary credit monitoring and identity protection services. BJC also recommends that affected patients review any statements they receive from their health insurers and health care providers. If patients see charges for services they did not receive, they should contact the insurer or provider immediately.

We regret any concern or inconvenience this incident may cause. We remain committed to protecting the confidentiality and security of patient information. To help prevent something like this from happening in the future, the accounts were secured and we are reinforcing education on how to identify and avoid suspicious emails.