13,000 Patients Potentially Impacted by Mercy Health Love County Hospital Breach
A Mercy Health Love County Hospital breach has potentially impacted more than 13,000 patients in Oklahoma.
On June 23, 2017, the hospital discovered an employee had stolen a laptop computer and paper records from a storage unit used by the hospital. According to the breach notice issued by Mercy Health, the records of 10 patients were taken from the storage unit along with the laptop.
The theft of PHI was initially investigated by the Love County Sheriff’s Office. That investigation revealed the former employee had used the stolen information to fraudulently obtain credit cards in the patients’ names. A second individual is also understood to have been involved.
While Mercy Health had up to 60 days to notify patients of the breach under HIPAA Rules, all ten patients were notified immediately. Mercy Health is working with the Love County Sherriff’s Office, the United States Postal Services, and the U.S. Secret Service which are all investigating the incident.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Mercy Health said in its breach notice, “Although there is no evidence that files belonging to patients aside from the ten patients originally identified were accessed or acquired without authorization, Mercy is nonetheless informing the public of the incident.” All affected patients have been offered 12 months of credit monitoring and identity theft repair services without charge.
Mercy Health Love County Hospital and Clinic Administrator Richard Barker said, “We are taking steps to secure all patient information to prevent anything similar from happening.”
While it would appear that the records of only 10 patients were stolen, a report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates a breach has been experienced involving 13,004 paper/film records.
It is currently unclear whether the storage unit contained the records of 13,004 patients, but only 10 patients’ files were taken, or if this is a separate incident. HIPAA Journal contacted Mercy Health for clarification but has yet to receive a response.
This post will be updated with further information as it becomes available.
