PUBLIC NOTICE

Web Notice to John Muir Health Patients Regarding Potential Impact to Protected Health Information – October 16, 2026

John Muir Health (JMH) is committed to protecting the confidentiality and security of our patients’ information. Regrettably, this notice concerns a security incident involving one of our outside vendors, HealthStream, Inc. (“HealthStream”), that may have involved 123 patients’ protected health information. Patients’ Social Security numbers, bank or credit card information, and health insurance information were not involved.

Individuals who do not receive a letter from JMH regarding this matter were most likely not impacted by this incident.

JMH utilized HealthStream to store and manage Medical Staff Services records, which included limited patient information.  

On July 29, 2026, HealthStream notified us that it had experienced a cyberattack of its own computer systems. HealthStream’s investigation found that between July 16 and July 17, 2026, an unauthorized person accessed and copied certain files on HealthStream’s network, and some of those files contained JMH patient information. This incident did not affect JMH’s own computer systems, including our electronic medical record (Epic).

After a thorough review, on September 14, 2026, JMH determined 123 patients’ information was in the files involved. The information varied by patient and may have included name, date of service, location of service, medical record number, procedure, provider license number/name, and proctor license number/name. While JMH has no indication that the information involved has been misused, we are notifying impacted patients and encouraging them to monitor for any potential incidents of fraud or identity theft. 

At JMH, protecting and securing patient information is a top priority. We deeply regret any inconvenience and concern this incident may have caused patients. Upon learning of this incident, JMH took immediate steps to investigate and identify all affected patient records and initiated our reporting responsibilities.  

If you have questions about this posting or would like to know more information, please contact the John Muir Health Privacy Office at 1-844-915-1230 or privacyoffice@johnmuirhealth.com.