The paper says the data for 20,000 patients, including names and diagnosis codes, remained on a commercial website for nearly a year until the breach was discovered late last month.
The Palo Alto hospital has been investigating how the material made its way from one of its vendors to a website that allows students to solicit paid assistance with their schoolwork.
Hospital spokesman Gary Migdol tells the paper that the data first appeared on the site as an attachment. He says it did not include Social Security and credit-card numbers or other information used to perpetrate identity theft.
