[Breaches](/breaches) Public Option: How Medical Records and Patient-Doctor Recordings Were Exposed [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Public Option: How Medical Records and Patient-Doctor Recordings Were Exposed ##### [UpGuard Team](/team/upguard) Published Sep 14, 2018 ##### Join 27,000+ cybersecurity newsletter subscribers The UpGuard Cyber Risk team can now disclose that detailed medical information for employees of 181 business locations, as well as [personally identifiable information (PII)](/blog/personally-identifiable-information-pii) for nearly 3,000 indivseiduals was publicly exposed in an unsecured [Amazon S3 storage bucket](/blog/check-your-amazon-s3-permissions-someone-will) belonging to [Medcall Healthcare Advisors](https://medcalladvisors.com/) (CSR score: 342), a “Workers Compensation and Healthcare Solutions” provider. Medcall’s workers compensation line of services act as an intermediary between employees and emergency care, with Medcall operators taking calls from enlisted persons, gathering information about them and their issue, and then connecting them with “someone board certified in emergency medicine.” Included in the exposed 7 gigabyte datastore were PDF injury intake forms for 181 different business locations across America, with PII, descriptions of injury and sickness, and details about the patient’s employment and employer. Also present were recordings of phone calls between patients, Medcall operators, and doctors. Finally, a directory of comma separated values (CSV) files contained PII including full Social Security Number for nearly 3,000 individuals enrolled through Medcall’s services. Although the number of affected individuals is relatively small when it comes to [other data breaches UpGuard has reported](/breaches), this incident serves as an example of how third and fourth party risk can compromise the privacy of individuals and companies if data handling practices are not properly monitored and controlled. Medical information is not just exploitable, but extremely personal, intimate, and its exposure entails more than just the possibility of fraud that accompanies all PII, a fact underlying the privileged status of the doctor-patient relationship. For additional coverage of this incident, see [databreaches.net](https://www.databreaches.net/data-of-almost-3000-patients-experiencing-emergency-symptoms-exposed-online-by-medcall-advisors/). ## **The Discovery** On August 24th, 2018 a member of the UpGuard [cyber risk](/blog/cybersecurity-risk) team discovered an insecure Amazon S3 storage bucket with the name “medcall.” The UpGuard cyber risk team began analysis of the contents of the bucket and determined it was extremely sensitive, with PII for thousands of people being exposed. The bucket was publicly *writable*, as was the ACL permission set, which had an “Everyone - Full Control” statement. The owner of the bucket was attributed to be Medcall Healthcare Advisors through multiple factors, including the name of the bucket, the username listed in the ACL permissions, “randy”, and the contents themselves, which include PDFs with Medcall letterhead and Medcall representatives in the recordings. On the afternoon of August 30th, UpGuard notified Medcall CEO Randy Baker about the exposure via email. By 9:30AM the next day, August 31st, the medcall bucket had been closed, preventing any future malicious use of the data. In addition to the exposure created by publicly readable assets, the medcall bucket was publicly writable as well, meaning any anonymous user could add, change, or delete files from the store. Furthermore, the permissions themselves were publicly writable, creating the potential for other malicious scenarios, such as the bucket owner being locked out of the resource entirely. Misconfigured S3 buckets remain a problem for companies of all sizes. The ‘everyone’ group should almost never be used, much less granted full control. Our [full blog post on securing Amazon S3 buckets can be found here](/blog/check-your-amazon-s3-permissions-someone-will). ## **The Contents** There were several types of sensitive files inside the medcall bucket: | | | | | ----------------------------- | ----------- | ---------------------------------------------------------------- | | Folder name | File count | Description | | injury-intake-call-recordings | 667 files | Recordings of calls for Medcall's Workman Comp service. | | emr-call-recordings | 48 files | Recordings of calls for Medcall's individual subscriber service. | | injury-intake | 1,149 files | PDF intake processing forms for Medcall's Workman Comp service. | | pdf | 1,749 files | Various PDF documents and forms. | | csv | 310 files | CSV files for PII for Medcall individual subscribers. | | eletronic report | 84 files | Various PDF documents and forms. | **Call Recordings (715 files) - **These folders contained audio files of recorded phone calls between employees, Medcall operators, and doctors. There is PII discussed in these calls, as well as medical problems and injury reports. Among the audio files are also a handful of recorded video calls.  **PDF Documents (2982 files) - **This collection of PDF files are primarily intake reports with PII, full social security numbers, injury and sickness descriptions, current medications, and other typical medical intake data. Also present are chart notes, including symptoms, diagnoses, medication prescribed, and other details. Medcall instructional documents, test documents and other assorted business files were also present in small numbers. **CSV Files - **The CSV files in this folder contain PII details including name, address, DOB, phone number, email address, full social security number, gender, and coverage level. Of the 310 files in the csv folder, one file, named 1487424421Base MedCallEligibilityReport\_2017-02-17 07\_00\_16.csv contained the bulk of the data, with approximately 2900 rows of information on almost as many individuals. The other files were much smaller and seemed to contain the same people present in the main file, so their count was omitted from this number. The “description” field identified the patient as the primary, spouse, or child. Of the approximately 2900 individuals, 540 entries identified the person as a child.  While it was not feasible to identify the natural person behind each of these entries, UpGuard analysts checked several individuals and consistently found corroborating evidence that matched their location, age, and gender. The headers present in this CSV were as follows: | | | | -------------------------------------------------------------- | ----------------------------------------------------- | | Patient ID/Auth Code (Medcall unique identifier) | Coverage level (Single, Married, Children, or Family) | | Description | Full Name | | Email | Home Address (City, State, Zip) | | Fixed Phone | Cell Phone | | Gender | Date of Birth | | Effective Date (of coverage, and cancelation where applicable) | Social Security Number |   ## **The Significance** According to its [website](https://medcalladvisors.com/), “MedCall Advisors is a comprehensive tele-emergent care medical service utilizing technology to immediately connect anyone experiencing a medical event with a physician Board Certified in Emergency Medicine.  Plan participants are able to access physicians through multiple mediums. Landline calls, smart phones and computers provide both audio and video consultations.” Exposed in the medcall dataset were 181 business locations across the United States, with nearly 150 unique businesses. Many of the affected companies are transportation businesses, while the others are comprised of a variety of different industries, including local government entities like county boards and school districts, and individual locations of large franchise chains, like Piggly Wiggly, KFC, and Hampton Inn. The full list of business locations with at least one exposed medical intake report for an employee are listed below. Almost all of Medcall's worker's compensation clients go through a distributor, these being [Key Risk](https://web.archive.org/web/20180824044033/https://keyrisk.com/virtualMD), [Peoplease](https://www.peoplease.com/solutions/risk-compliance-services/), and [W.R. Berkley](https://www.berkley.com/our-business/operating-units).  The scope of affected businesses illustrates how an exposure for a single entity in a supply chain creates ripples throughout the entire digital ecosystem.  Technology furnishes healthcare services with additional functionality, reduces the time it takes to perform them, and allows those operations to scale without much change in quality for the individual. However, this technological abstraction also introduces new risk, risks that can make otherwise confidential information publicly accessible. The PII present in the Medcall data is more than enough for the individuals within to have had their identities stolen, if a malicious actor were to have accessed it. The medical details reveal an even more private world, that of individuals dealing with their own bodies, and the specialists who help with them. The healthcare industry has a [long history of data privacy issues](https://en.wikipedia.org/wiki/Medical_data_breach), because of both the sensitivity of medical data and the complex infrastructure required to manage information at such a scale. The processes by which [sensitive information](https://www.upguard.com/blog/sensitive-data) is handled and stored must have controls that prevent exposure, especially when utilizing internet-facing cloud technology. Privacy violations create more distrust in the already divisive relationship between healthcare companies and the people who rely on them. ## **Conclusion** The digitization of information coupled with internet-facing storage technologies has created an environment where large amounts of information— including sensitive information— can be aggregated, centrally stored, and made available anywhere in the world. The advantages this provides are self-evident by now, but the risks taken on by the same factors only become clear when information becomes exposed. It should be the responsibility of any organization that handles sensitive data to protect the integrity of that data with secure systems and controlled processes across their digital presence, including, and perhaps especially, their vendors. ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ## Related breaches Learn more about the latest issues in cybersecurity. [](/breaches/cyber-risks-of-the-2026-world-cup) #### [Own Goal: Inside the Cyber Risks of the 2026 World Cup](/breaches/cyber-risks-of-the-2026-world-cup) Free World Cup streams and black-market betting sites are leaking fan data. UpGuard research reveals the hidden cyber risks of the 2026 tournament. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) June 30, 2026 [](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) #### [Social Insecurity: Billions of Social Security Number and Passwords](/breaches/social-insecurity-billions-of-social-security-number-and-passwords) UpGuard research found a trove of sensitive information in an exposed Elastic database. Getting to the bottom of what it meant led us down an interesting path. [](/team/greg-pollock) [Greg Pollock](/team/greg-pollock) February 18, 2026 [](/breaches/angelsense-data-leak) #### [Sixth Sense: GPS and AI Data Exposed for Assistive Devices](/breaches/angelsense-data-leak) UpGuard can now report that it has secured an Elasticsearch database for AngelSense, a GPS tracker for children and adults with special needs. [](/team/upguard) [UpGuard Team](/team/upguard) January 30, 2025 [](/breaches/pta-database) #### [Stolen Data: National PTA Database Available on Dark Web](/breaches/pta-database) On May 13th, UpGuard discovered a new set of data recently posted on a prominent dark web forum, this time allegedly belonging to the National Parent Teacher Association. [](/team/upguard) [UpGuard Team](/team/upguard) May 14, 2024 [](/breaches/smarterselect) #### [Student Applications: How an Education Software Company Exposed Millions of Files](/breaches/smarterselect) UpGuard can now report that a public Google Cloud Storage bucket containing approximately 1.5 terabytes of data used to administer funding programs for college students has been secured. The bucket belonged to SmarterSelect, a company that provides software for managing the application process for scholarships, grants, and awards. The more than 2.8 million files included documents like transcripts, resumes, personal essays, tax returns, and invoices for approximately 1.2 million applications to funding programs. [](/team/upguard) [UpGuard Team](/team/upguard) November 22, 2021 [](/breaches/power-apps) #### [By Design: How Default Permissions on Microsoft Power Apps Exposed Millions](/breaches/power-apps) 38 million records were exposed in multiple data leaks resulting from misconfigured Microsoft Power Apps portals. Data included sensitive information such as COVID-19 contact tracing data, COVID-19 vaccination appointments, social security numbers for job applicants, employee IDs, and millions of names and email addresses. [](/team/upguard) [UpGuard Team](/team/upguard) August 23, 2021 [View all breaches](/breaches) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)