Where Does Your Nurse Schedule Live, and Who Can See It?

Key Takeaways

• The Philadelphia Inquirer found that about fifty health systems had web pages showing clinician schedules, and in some cases cell phone numbers, reachable without a login. Penn Medicine, Johns Hopkins Medicine and the University of California San Francisco were among them.
• No patient information was involved. The platform in question does not hold any. That is exactly why the usual privacy reflex misses what is at stake.
• A schedule states where a named person will physically be, at what hour, weeks in advance. Security and privacy experts told the Inquirer that combining that with a cell number is what creates the risk.
• How the pages became public has not been established, and the Inquirer is explicit about that. No harm to any worker has been reported. What is documented is that the tool has a feature for sharing a schedule without a login, and that these pages were reachable without one.
• At least ten health systems removed the public link or added a password after being contacted by reporters.
• A 25-bed hospital rarely has one schedule. It has a posted copy, a texted copy, an emailed copy and a file on a shared drive, and each copy answers “who can see it” differently.

Table of Contents

• What Happened at About Fifty Health Systems?
• Why Is a Nurse Schedule a Safety Document?
• Where Does a Small Hospital’s Schedule Actually Live?
• Who Is Responsible for Locking It Down, the Vendor or the Hospital?
• What Should You Ask a Scheduling Vendor About Public Schedule Access?
• How Does SimpleScheduleAI Help?
• What to Do This Week
• Frequently Asked Questions

When this story broke in August, the natural first question was whether any patient records had been exposed. None had been. That answer is true, and it lets a hospital stop too early, because the people a schedule exposes are the staff on it rather than the patients.

So the useful question is not whether a large health system got caught out. It is where the copies of your own schedule come to rest, and who can see each one.

What Happened at About Fifty Health Systems?

The Philadelphia Inquirer reported on 31 August 2026 that daily work schedules and cell phone numbers of healthcare workers were publicly reachable. The pages were hosted by the scheduling vendor QGenda. Reporters started from a confidential tip about three East Coast health systems and identified roughly fifty institutions with public pages. Those named include Penn Medicine, Children’s Hospital of Philadelphia, ChristianaCare, Johns Hopkins Medicine, the University of California San Francisco and Cedars-Sinai Medical Center.

First, nobody has established how this happened. The Inquirer says so plainly. It is not clear how the schedules became public, how long they were reachable, how much administrators knew, or whether anyone looking to cause harm ever opened one. What is documented is that QGenda offers a “QuickLinks” feature letting “any staff member without a QGenda account” reach a schedule. That is a reasonable thing for a hospital to want, and a dangerous setting to leave switched on. Nobody has shown that this feature is how each of these pages became reachable, so treat it as the likely explanation and not a proven one. QGenda’s own materials acknowledge that on-call schedules “may contain sensitive information” and carry a risk of “unauthorized access or data breaches”. The company did not respond to the Inquirer’s requests for comment.

No patient data was exposed, because the platform does not hold any. A hospital that checks for exposed patient records, finds none, and stops there has answered the wrong question. The names, shifts and phone numbers on the page all belong to staff.

At least ten health systems, including Johns Hopkins and UCSF, removed the public link or added a password requirement after reporters contacted them.

Why Is a Nurse Schedule a Safety Document?

A schedule doubles as a movement log for named people. It says a specific nurse is on nights in the emergency department on the 14th, the 15th and the 16th, three weeks before it happens. Pair that with a mobile number and you have published where someone will be and how to reach them.

That combination is the risk the experts quoted by the Inquirer pointed to. Sharona Hoffman, a law professor at Case Western Reserve University, said the combination of cell numbers and work schedules “could be used to cause harm, whether by patients, politically motivated individuals, or stalkers”. Will Owen of the Surveillance Technology Oversight Project told the paper that “hospitals must scrutinize the platforms they work with in their data collection to minimize information that can be weaponized”. Doctors quoted in the piece were most worried about colleagues who provide care that draws threats, naming work with undocumented patients and gender-affirming and abortion care.

Worth saying plainly: no one has reported being harmed because of these pages. The concern is what the combination makes possible, not a documented incident.

For a rural hospital the exposure runs the other way from what you might expect. A 400-bed system has dozens of nurses on any given night, so a schedule identifies a crowd. At 25 beds, the night shift may be two people. A published schedule there describes two named individuals, and in a small town most readers can already put a face and an address to the name.

Where Does a Small Hospital’s Schedule Actually Live?

This is the part the national coverage cannot help you with, because a small hospital’s schedule usually does not live in one system at all. Before deciding whether a vendor is the risk, count the copies.

Walk your own cycle and mark each place a copy comes to rest.

Expect several rows to apply at once rather than just one. The scheduling platform is a single row out of six, which is the point. Auditing the vendor while the group text keeps circulating fixes the smallest leak first.

Who Is Responsible for Locking It Down, the Vendor or the Hospital?

Both. The vendor owns the default and owes you a plain description of what a setting does. The hospital owns the settings on its own account. The usual failure is mundane: a setting someone switched on three years ago for a good reason, which nobody has looked at since that person left.

Some hospitals go through their software once a year and confirm who still has access to what. If yours does, add the scheduling tool to that list and write down whose job it is to check. Plenty of small hospitals have no such review and nobody in IT to run one. There, the version that works is a calendar reminder for the nurse manager or the administrator to re-open the sharing settings every time someone leaves.

What Should You Ask a Scheduling Vendor About Public Schedule Access?

Six questions, and they work on any vendor including this one. Ask for a demonstration rather than an assurance. If you do not hold the contract, and most nurse managers do not, send these to whoever does, usually the administrator or whoever signed the software. A good answer is a screen share of your own account. A bad answer is the word “secure” without a setting attached to it.

1. Can a schedule be reached without logging in? Vendors name this differently, so ask by what it does rather than by feature name. Then have them show you where it lives and what it is set to on your account today.
2. What exactly appears on a shared schedule? Surnames, mobile numbers, home unit, or just first name and shift. Show me the actual output, not the settings page.
3. Who at our hospital can turn public sharing on? Any manager, or only an administrator, and does anything notify us when it changes?
4. When someone leaves, what happens to their access and their phone number? Walk through it step by step for a nurse who quit last month.
5. What do you send to a third party, like an agency? Ask for a sample of the actual file.
6. Can you show me a log of who viewed or changed the schedule? A record of changes is not the same as a record of views; ask which one you get.

Write the answers down. The value of asking is not the reassurance, it is having a dated record of what you were told.

The question underneath all six, and the one a nurse manager asks first: were we one of the fifty? The only reliable way to find out is to ask your vendor in writing whether any public link exists on your account, and to open the setting yourself. Do not go hunting for other hospitals’ pages to compare against.

How Does SimpleScheduleAI Help?

It helps less than you might expect from a vendor writing about this, and being straight about that is the point of the section.

SimpleScheduleAI is an AI-native nurse scheduling service for Critical Access Hospitals in Texas. The AI builds the schedule, a scheduling team checks it, and the nurse manager approves it. The approved schedule reaches the nurse manager as a PDF and an Excel file, and the hospital posts it however it posts schedules today. Nurses do not log into anything, because there is nothing for them to log into.

That moves the question rather than settling it. Once a PDF is in the manager’s hands, it goes on a wall or into a text thread like any other schedule, and every row in the table above applies again. This removes one place the schedule can sit. It does not remove the other five, and no vendor’s product page should claim otherwise.

What is genuinely useful here is narrower. Every schedule change is logged with a timestamp and the log exports, so “who changed this and when” has an answer. That is the audit trail a surveyor asks about, and it is a change record rather than a view record. Ask us question six above and that is the honest answer you will get.

One honest limitation, and it bears directly on this article: because nurses have no app, they see the schedule the old way, on a wall or in a message from their manager. That is the same paper trail described above. If you want nurses viewing and swapping shifts themselves, this is the wrong tool and you want a self-serve platform such as the ones reviewed in our nurse scheduling app comparison. It is also not built for hospitals outside Texas or rosters above 40 nurses.

None of the above is a security claim, and we would rather not make one. Put the six questions to us the same way you would to anyone else. For how the service works in full, see how it works, our nurse scheduling software hub, the rules that shape critical access hospital scheduling, and how AI nurse scheduling builds a draft.

What to Do This Week

1. Count your copies. Walk one cycle and list every place the schedule comes to rest, using the table above. Expect more than one.
2. Open your scheduling tool and look for a share-without-login setting. Find out whether it exists and what it is set to. If you cannot find it in ten minutes, that is your first question for the vendor.
3. Check what is actually printed on the wall copy. If it carries full names and mobile numbers, ask whether the unit needs both. First name and last initial usually tells three nurses named Jessica apart without publishing anyone in full.
4. Prune one distribution list and one group thread. Start with people who have left. This is the cheapest fix on the list and nobody ever schedules it.
5. Put scheduling into your next access review by name. A date and an owner, alongside the systems you already review.

Frequently Asked Questions

What happened and how bad is it

Was this a data breach?

The reporting describes a configuration problem rather than an intrusion. Pages that a vendor feature makes reachable without a login were left reachable, and reporters found them. Whether it meets any given legal definition of a breach depends on the state and on what was exposed, which is a question for your counsel rather than for a vendor’s article.

Was patient information exposed?

No. The Inquirer reported that the platform does not contain patient information. That is why treating this purely as a privacy incident understates it; the exposure was of staff, not patients. Where scheduling genuinely does touch patient data, and when a business associate agreement is required, is a separate question covered in our guide to HIPAA and scheduling software.

Does this mean the vendor is unsafe to use?

That is not what the reporting shows. The controls existed and were not enabled by the health systems using them. The useful question is not which vendor to avoid, it is which settings are switched on in your own account today.

What a small hospital should do

How do I find out whether our schedule is reachable?

Ask your vendor, in writing, whether any public or no-login link exists on your account, and open the sharing settings yourself while you wait for the answer. Keep the reply. If you have no scheduling platform, the same question applies to your shared drive and any folder link set to “anyone with the link”.

We only have 30 nurses. Is this really our problem?

The smaller the roster, the more completely a schedule identifies individuals. Two named people on a night shift in a small town is more identifying, not less, than forty names at a large hospital.

We do not use a scheduling platform at all, just a spreadsheet. Are we fine?

The platform is one row of six in the table above. A spreadsheet emailed to a stale distribution list and printed with mobile numbers on it reaches the same outcome by a slower route.

Who at a small hospital should own this?

Whoever owns the software contract, usually the administrator, owns the vendor questions. The nurse manager owns the copies: the wall, the thread, the emailed file. Splitting it that way keeps it from becoming an IT project nobody has staff for.

What is the single highest-value thing to check?

Whether any tool you use can show the schedule to someone who is not logged in, and whether that is currently switched on. Everything else on the list is worth doing, but that is the one that put fifty health systems in the news.

Sources

[1] Philadelphia Inquirer, “Links exposed physician cell numbers and work schedules at health systems in Philly and nationwide”, 31 August 2026. The source for every factual claim about the incident in this piece. inquirer.com. Retrieved 2026-09-12.

[2] Becker’s Hospital Review, “Nearly 50 hospitals, health systems had public links exposing clinician schedules: Report”. Secondary trade coverage of the same reporting. beckershospitalreview.com. Retrieved 2026-09-12.

A note on sources: every factual claim about the incident above comes from the Philadelphia Inquirer’s reporting, which is the primary account. Becker’s is listed as corroborating trade coverage and is not quoted here, because its page blocks automated retrieval and we do not quote what we cannot read directly. Quotations from security and privacy experts appear as the Inquirer published them. SimpleScheduleAI competes with the vendor named in this story, which is a reason to read our framing critically; the advice above is written to apply to any scheduling tool, including ours.

Pradeep Pandey is the co-founder of SimpleScheduleAI. He serves as Deputy General Manager of Operations at Apollo Hospitals and holds an MBA from IIM Trichy (Operations and Marketing). His work focuses on workforce optimization and scheduling operations for Critical Access Hospitals and other small rural facilities. LinkedIn →