150,000 Records of Home Health Care Firm Exposed on Web

An unencrypted database containing nearly 150,000 patient records of a California-based provider of home health and palliative care services was left exposed on the internet, said a cybersecurity researcher who discovered the unsecured data cache.

See Also: Using the Netskope HIPAA Mapping Guide

The exposed 23.7-gigabyte database contained medical documents that included names, patient ID numbers, Social Security numbers, physical addresses and phone numbers belonging to Archer Health, said researcher Jeremiah Fowler, who described his findings in a report issued on Thursday.

The database also included documents labeled as assessments, home health certifications, plan of care documents and discharge forms that contained personally identifiable and protected health information, including diagnoses, treatments and “other potentially sensitive health-related data that should not be publicly exposed,” he said.

Fowler said it is unclear whether the non-password protected database was owned and managed directly by Archer Health or by a third-party contractor. It is also not known how long the database was exposed before Fowler discovered it, he said.

“The ‘date modified’ on nearly all the files were from 2025, so it is possible this occurred in 2025 when a new storage or CRM system was created and misconfigured to allow public access,” he told Information Security Media Group. “It is hard to pinpoint just how long the files were exposed based on the available information.”

Upon notifying Archer Health of his findings, the database was restricted from public access within hours and is no longer accessible, he said.

“This type of exposure can happen due to improper firewall configuration settings, public access settings or simply a mistake,” said Fowler, who has previously discovered many other exposed databases containing other organizations’ records in healthcare and other sectors (see: Clinical Trial Database Exposes 16M Records to Web).

“I have seen many cases where an organization has multiple locations and employees or contractors that all need to upload or access documents. Technically, it can be difficult to manage access credentials and controls for large teams so the files may be delivered to a password protected CRM or similar dashboard, while the files themselves are stored in bulk in a single place without a password,” he said.

Archer did not immediately respond to ISMG’s request for comment on Fowler’s findings.

Overall, companies in the healthcare industry have become much better at data security in recent years, but unfortunately some of these changes were the result of the industry being among the most targeted for ransomware and other attacks and the financial penalties of HIPAA violations, Fowler said.

“No matter what caused these changes, I am happy to see the industry being more proactive and I am finding less health data these days,” he said.

But when data exposure occurs, human error is the most common reason, Fowler said. “Coding, development and data security are not usually skill sets that medical professional have and they often must depend on third-party contractors or vendors to provide these services,” he said.

“Once the data is transferred out of the provider’s chain of custody, it significantly increases the risks.”

At least one of Fowler’s discoveries has ended up in court. Last month, Ohio Medical Alliance, which does business as Ohio Marijuana Card, was hit with a proposed class action lawsuit following Fowler’s findings of an exposed database containing the personal records of nearly one million medical marijuana patients (see: Medical Cannabis Firm Sued Over Health Data Exposure).