It’s 2026, but Hospitals Still Haven’t Prevented Snooping in Celebrities’ Records

Why It Matters

The breach underscores ongoing compliance risks for healthcare providers and erodes patient trust, potentially inviting regulatory penalties and reputational damage.

Key Takeaways

• Celebrity patient alleges staff accessed his medical records
• Employees took selfies in patient’s treatment area
• Hospital failed to respond to breach inquiry
• HIPAA violations expose hospitals to hefty fines
• Improved audit logs needed to enforce ‘break‑glass’

Pulse Analysis

Privacy breaches in hospitals remain a stubborn challenge, even as 2026 brings sophisticated electronic health record (EHR) platforms. While many institutions have adopted “break‑the‑glass” protocols that log and limit emergency access, enforcement often falters at the human level. The Josh Clarke incident illustrates how cultural lapses—staff treating a celebrity’s chart as a curiosity—can bypass technical safeguards, leading to clear HIPAA violations and exposing facilities to fines that can reach millions of dollars.

Regulators are tightening scrutiny, with the Office for Civil Rights (OCR) increasing audit frequency and imposing higher penalties for repeated infractions. Hospitals that fail to demonstrate robust audit trails, real‑time monitoring, and swift disciplinary actions risk not only monetary sanctions but also loss of accreditation and patient confidence. The lack of a public response from the Michigan hospital signals a missed opportunity to reassure the community and showcase corrective measures, a misstep that competitors can exploit.

To mitigate future incidents, healthcare leaders must blend technology with a strong privacy culture. Implementing automated alerts for atypical record access, mandatory privacy training that emphasizes the sanctity of patient data, and transparent breach communication policies are essential steps. As the industry moves toward interoperable health networks, protecting celebrity and everyday patient records alike will be a litmus test for an organization’s commitment to security and trust.

It’s 2026, but hospitals still haven’t prevented snooping in celebrities’ records

DataBreaches · February 12 2026

DataBreaches is not on TikTok and, being something of a dinosaur, never heard of “Josh and Jase” before. But no patient should have their privacy violated the ways Josh’s was.

What happened to “break the glass?” What happened to all the software and auditing protections to prevent hospital employees from snooping on celebrity patients’ records?

A hospital in Michigan is getting a lot of negative press after Josh Clarke, of “Josh and Jase” fame, revealed he was the victim of a worrying privacy breach. He did not name the hospital publicly, but the hospital sent him a letter about the breach. Media coverage of Josh’s emergency hospitalization had tied it to the Petoskey, Michigan area.

The video post is on Facebook at https://www.facebook.com/reel/1595824178233857.

The news coverage quoted him:

“Staff members were entering the room I was in whilst receiving treatment and asking for selfies (there are witnesses to this) whilst I was under medication and in pain and I’ve kept quiet about this but to learn employees have accessed my personal private information for their own knowledge, is not okay,” he said in the video. “They also explained to me they had taken my name off of the notice board to keep things low‑key. The word got around. I am all for meeting fans and being polite and will never turn down meeting someone, however lines and boundaries have been crossed and it comes to a time where I need to take a stance.”

Petoskey, Michigan appears to have only one hospital/emergency room, and that is McLaren Northern Michigan. Some of the video clips posted by Josh and Jase taken in the hospital appear to show backgrounds compatible with McLaren’s emergency room or halls. DataBreaches submitted an inquiry to the hospital via its contact form to ask if they would confirm the breach was at their facility, and if so, what they have done with respect to the involved employees and what they have done to prevent a future incident of this kind.

No reply has been received, but this post will be updated if one is received.