Two staff members of Phoenix Children’s Hospital filed a lawsuit after employees who received a mandatory vaccine exemption were able to see each other’s email addresses.

Hospital administrators sent an email containing a safety agreement to unvaccinated workers last month, but did not put 368 recipients in the BCC field.

The workers claimed that the hospital had neglected their private health information. Their lawyer, Alexander Kolodin, is seeking class action status.

A hospital official said in a statement: “Since learning of our administrative error, we immediately notified the affected employees of the error and expressed our sincere apologies and explained that measures have been taken to avoid similar errors in the future.” Statement to KSAZ-TV.

Not a modern healthcare subscriber? Register today.