PeaceHealth Sacred Heart Medical Center is a hospital in Springfield, Oregon, and part of the PeaceHealth system. The hospital has notified patients that an employee looked at their medical records without a job-related reason. This kind of incident, often called snooping, is different from an outside hack, but it is still a breach of patient privacy that people have a right to understand.
PeaceHealth Sacred Heart Medical Center’s Data Breach Investigation
According to the notice PeaceHealth posted on its website, Sacred Heart Medical Center recently discovered that an employee had accessed medical records without a work-related reason. The notice gives the dates August 11 and September 2, 2026, in connection with the discovery. It says the unauthorized access itself took place between March 21 and August 3, 2026, a period of more than four months. PeaceHealth states that all affected patients have been notified by postal mail.
The Oregon Department of Justice’s public breach listing records 334 people as affected by the incident. That figure reflects the number the organization gave in its initial report to the state. The state’s database notes that later updates are not reflected in the public listing, so the number could change.
The type of incident matters. Unlike an attack by outside criminals, this involved a person who was already authorized to use the hospital’s records system and who is alleged to have looked at patient charts without a legitimate need. Hospitals typically monitor access to electronic health records and review audit logs, and that kind of review is a common way inappropriate access comes to light. PeaceHealth has not described how it identified this one.
PeaceHealth says that after learning of the incident it investigated and took appropriate corrective action. It states that the employee involved is no longer employed by PeaceHealth, and that it is taking steps to help prevent a similar incident from happening again. The notice does not describe what those steps are, and it does not say whether the information was copied, shared or used beyond being viewed.
The notice lists the information that may have been viewed. It includes a patient’s name, date of birth, age, gender, race or ethnicity, preferred language, address, phone number, email address, patient contacts and medical record number. It also includes clinical details such as vital signs, height, weight, fluid intake and output, IV assessments, infection or isolation information, allergies, medications, lab orders and results, diagnoses, health concerns, visit history, procedure dates and times, physician notes, nursing notes, respiratory therapy notes and discharge planning information.
PeaceHealth states that, based on its investigation and the type of information involved, it does not believe the incident creates a risk of identity theft or financial fraud, and that no financial information was accessed. That is the organization’s own assessment. Patients are entitled to weigh it for themselves, and many people are concerned about the privacy of their diagnoses, medications and clinical notes whether or not a financial risk exists.
Incidents of this type can be unsettling for a particular reason. Medical charts contain details that patients may not share even with family members, and the person who viewed them may have known the patient personally. The hospital’s notice does not say whether the employee knew any of the affected patients, and it does not say what motivated the access, so we do not speculate on either point.
Patient privacy rules require healthcare organizations to limit access to medical records to people who need them for treatment, payment or hospital operations. Access without such a reason can be a violation of those rules, even when no data leaves the building. Breaches of this kind are reported to regulators and, when they involve enough people, to the public, which is why the incident appears in the state’s breach listing.
The hospital set up phone lines for patients with questions, including a toll-free number. If you received a letter from PeaceHealth, keep it. It explains how the incident applies to you. If you were treated at Sacred Heart Medical Center during the period in question and have not received a letter but want to know whether your records were involved, the numbers on the hospital’s notice are the most direct way to ask. This page reflects only what PeaceHealth and the state of Oregon have made public. Where a detail has not been disclosed, we say so rather than speculate.
When Did This Breach Occur?
PeaceHealth says the unauthorized access took place between March 21 and August 3, 2026. The hospital’s notice states that it discovered the incident on August 11 and September 2, 2026, and that all affected patients were notified by postal mail.
What Information Was Breached?
The information the employee may have viewed included a patient’s name, date of birth, contact details, medical record number and a range of clinical information such as vital signs, medications, lab orders and results, diagnoses, visit history, and physician, nursing and respiratory therapy notes. PeaceHealth says no financial information was accessed. The hospital states it does not believe the incident creates a risk of identity theft or financial fraud.
What You Can Do
If you received a notice from PeaceHealth, consider these steps:
- Keep the notification letter and read the details it gives about your records.
- Call the number listed on the notice if you have questions about what was viewed.
- Review the explanation-of-benefits statements from your health plan for services you did not receive.
- Consider requesting a copy of your medical records and an accounting of disclosures from the hospital.
- Monitor your accounts and credit reports as a routine precaution.
- Report suspected misuse of your information to the Federal Trade Commission and your state Attorney General.
File a Data Breach Lawsuit Against PeaceHealth Sacred Heart Medical Center
If you received notice that your medical records may have been viewed in the PeaceHealth Sacred Heart Medical Center privacy breach, you may be entitled to compensation. Hospitals that hold sensitive medical information are expected to keep it from being accessed without a legitimate reason, and people affected by a privacy breach can face lasting concerns about how their information is used.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
