Recently, Jackson County Hospital District confirmed that the company experienced a data breach after an unauthorized party gained access to the hospital’s computer network and the sensitive patient and employee data contained on the network. According to Jackson Hospital, the breach resulted in the names, dates of birth, contact information, Social Security numbers, medical history, medical conditions or treatment information, medical record numbers, diagnosis codes, and patient account numbers being compromised. In all, 98,746 patients and employees are believed to have been impacted by the breach. On May 6, 2022, Jackson Hospital filed official notice of the breach and sent out data breach letters to all affected parties.

If you received a data breach notification, it is essential you understand what is at risk and what you can do about it. To learn more about how to protect yourself from becoming a victim of fraud or identity theft and what your legal options are in the wake of the Jackson Hospital data breach, please see our recent piece on the topic here.

What We Know About the Jackson Hospital Data Breach

According to official notice filed by the company, on around January 9, 2022, Jackson Hospital detected unusual activity on some of its computer systems. More specifically, certain computer systems had become inaccessible. In response, Jackson County Hospital District enlisted the assistance of third-party cybersecurity specialists to investigate the incident and determine whether any patient or employee data was compromised as a result.

On January 11, 2022, Jackson Hospital learned that an unauthorized party accessed the hospital’s systems and removed certain files containing sensitive patient and employee information.

Upon discovering that sensitive consumer data was accessible to an unauthorized party, Jackson Hospital then reviewed the affected files to determine exactly what information was compromised. While the breached information varies depending on the individual, it may include your name, date of birth, contact information, Social Security number, medical history, medical condition or treatment information, medical record number, diagnosis code, and patient account number. According to an official filing, the Jackson Hospital data breach affected 98,746 patients and employees.

On May 6, 2022, Jackson Hospital sent out data breach letters to all individuals whose information was compromised as a result of the recent data security incident.

More Information About Jackson County Hospital District

Jackson County Hospital District is a hospital located in Edna, Texas, that provides general medical and surgical care for inpatient, outpatient, and emergency room patients. Some of the services Jackson Hospital provides include cardiopulmonary care, emergency care, radiology, laboratory testing, surgical services, and physical therapy. Jackson Hospital employs more than 130 people and generates approximately $130 million in annual revenue.

Can Medical Providers Be Held Liable Following a Data Breach?

Yes, medical providers can be held liable through a data breach lawsuit. However, just like other types of businesses, doctors and other healthcare providers are not automatically liable following a data breach. While data breach laws are state-specific, in most states, a patient must be able to show that the healthcare provider’s negligence led to the breach. Of course, this doesn’t mean that the provider conducted the breach or wanted it to occur; only that they failed to implement the necessary data security systems to prevent against that specific type of attack.

The data breach laws in the United States allow for victims to recover financial compensation from negligent organizations; however, these cases are often very complex. Anyone interested in learning more about a healthcare provider's liability following a data breach should reach out to a dedicated data breach law firm for immediate assistance.

Below is a copy of the initial data breach letter issued by Jackson County Hospital District (the actual notice sent to consumers can be found here):