The personal data of more than 13,000 patients at Mercy Health Love County Hospital in Oklahoma may have been breached.
On June 23, 2017, the hospital found that an employee had stolen a laptop computer and paper records from a storage unit which was owned by the hospital. The breach notice broadcast by Mercy Health revealed that the records of 10 patients were taken from the device along with the laptop.
The theft of PHI was first investigated by the Love County Sheriff’s Office. That showed the former member of staff had used the stolen data to fraudulently obtain credit cards in the patients’ names. A second person is also understood to have been involved.
Mercy Health had up to 60 days to make patients aware of the breach under HIPAA Rules. However, all ten patients were notified immediately. Mercy Health is cooperating with the Love County Sherriff’s Office, the United States Postal Services, and the U.S. Secret Service which are all reviewing the incident.
Mercy Health said in its breach notice, “Although there is no evidence that files belonging to patients aside from the ten patients originally identified were accessed or acquired without authorization, Mercy is nonetheless informing the public of the incident.” All patients who may have been targeted in attack have been offered 12 months of credit monitoring and locate theft repair services without charge.
Mercy Health Love County Hospital and Clinic Administrator Richard Barker remarked, “We are taking steps to secure all patient information to prevent anything similar from happening.”
Despite the act that it appears the records of just 10 patients were stolen, a report filed with the Department of Health and Human Services’ Office for Civil Rights shows a breach has been suffered involving 13,004 paper/film records.
It is not yet clear if the storage unit contained the records of 13,004 patients, if just 10 patients’ files were taken, or if this is a completely separate incident. HIPAA Journal contacted Mercy Health for clarification but has yet to receive a response.
This post will be updated with further information as it becomes available.
