Baylor Scott & White Texas Spine & Joint Hospital Data Breach 2025: 1,640 Affected · Hacking/IT Incident · TX. Filed With HHS OCR. What To Do.

Baylor Scott & White Texas Spine & Joint Hospital, a Tyler, Texas surgical hospital, reported a HIPAA breach to the U.S. Department of Health and Human Services Office for Civil Rights on March 14, 2025, affecting 1,640 individuals. The OCR portal classifies the event as a Hacking/IT Incident at Email. According to the hospital’s own substitute notice and contemporaneous reporting by KLTV, CBS19, and Becker’s Spine Review, an unauthorized third party accessed a single Microsoft 365-hosted business email account for about four days in January 2025 before the intrusion was detected and contained.

Timeline

• January 10, 2025 — Unauthorized access to a Microsoft 365 email account begins.
• January 14, 2025 — Unauthorized access ends; the access window spans four days.
• January 15, 2025 — The hospital discovers the compromise and begins its investigation with outside forensics and counsel.
• March 14, 2025 — The hospital reports the incident to HHS OCR, posts a substitute notice on tsjh.org, and mails individual notification letters to the 1,640 affected patients.

What was exposed

The hospital’s substitute notice describes the data that may have been present in the compromised mailbox. Specific elements vary by individual and not every category applies to every affected person:

• Full name, date of birth, and address
• Medical and treatment information, including dates of service, provider and facility names, and procedure codes
• Billing and claims information, including account or claim status, transaction and charge identification numbers, patient account identifiers, and payor information

The hospital states the following data elements were not involved: Social Security number, driver’s license number, credit and debit card information, bank account information, and account passwords.

What the hospital is offering

The substitute notice does not advertise complimentary credit monitoring or identity-theft protection. Because Social Security numbers and financial account data are described as not implicated, the hospital’s offering focuses on general guidance: monitoring account statements, reviewing free credit reports, and considering fraud alerts. A toll-free call center at 1-800-939-4170 was made available for 90 days after the notice for affected individuals with questions.

Class-action posture

Plaintiff-side firms including Console & Associates and Srourian Law Firm publicly announced investigations into potential class claims shortly after the March 14, 2025 notice. As of this page’s last update, no consolidated complaint or certified class has been identified in the public record; the matter remains at the pre-litigation investigation stage from the plaintiffs’ bar perspective, and the HHS OCR investigation remains open.

What to do if you may be affected

• Read your notification letter carefully. The letter sent to your address on file will list the specific data elements that appeared in your record. Hold onto it; class-action firms and any future settlement administrator will ask for it.
• Place a fraud alert or credit freeze. Even though SSNs and financial accounts are not described as involved, the dates-of-birth, addresses, and medical detail in this breach are useful inputs for medical-identity and synthetic-identity fraud. A free credit freeze with the three nationwide bureaus is the highest-leverage protective step.
• Watch your Explanation of Benefits statements. Review every EOB from your health insurer and flag any procedure, provider, or facility you do not recognize. Medical-identity theft typically surfaces in claims data before it surfaces on a credit report.
• Be wary of phishing. Treat unexpected calls, texts, or emails referencing your care at Texas Spine & Joint Hospital with suspicion. The hospital will not ask for your Social Security number or financial information over the phone in connection with this incident.
• Use the hospital’s call center while it is open. 1-800-939-4170 was set up specifically for this incident and is the fastest route to confirm whether your record was among the 1,640 affected.

Sources on this page

• HHS Office for Civil Rights Breach Portal — federal regulatory record of this breach (1,640 individuals, Hacking/IT Incident, Email, reported March 14, 2025).
• Notice of Data Security Incident — the hospital’s own substitute notice describing the access window, the data categories involved, and the call-center contact.
• KLTV news report — local East Texas television coverage at the time of disclosure.
• CBS19 news report — Tyler, Texas television coverage confirming the notice.
• Becker’s Spine Review — trade-press coverage in the orthopedic and spine sector.
• JDSupra (Console & Associates P.C.) — plaintiff-firm summary including the class-action investigation posture.