BJC HealthCare Accountable Care Organization ( BJC ACO ) has notified 2,393 patients that identifying information was sent to a participating medical practice through an unencrypted email . All affected patients have been offered identity theft protection free of charge . BJC ACO discovered on Dec. 30 , 2015 , that an email containing health information without the required security encryption was sent to a participating BJC ACO medical practice . The email was delivered to the correct and intended recipient . It contained a list of patients that included name , gender , date of birth and Medicare beneficiary identification number . The email did NOT contain medical information such as diagnosis , tests , results , treatment or hospitalization , or financial data . BJC ACO investigated the email transmission and has discovered no indication that anyone other than the intended and authorized recipient at the medical practice read or accessed the email . BJC ACO has taken steps to re - educate staff on the process for sending emails in a secure manner . Encryption is a process that translates information into a format that can not be easily understood by an unauthorized recipient . It is required to be used when transmitting protected / personal health information ( PHI ) between health care providers . ;