Mercy Hospital, Iowa City, Iowa

Mercy Iowa City, a healthcare provider, reported an external system breach (hacking) occurring on May 15, 2020, discovered on October 3, 2020. The incident affected 92,795 individuals, including 5 Maine residents. Compromised data included names and Social Security Numbers. The entity notified affected individuals in writing on November 13, 2020, and offered one year of identity theft protection services.

Mercy Iowa City (IA) reported to HHS OCR on 2020-11-13 a Hacking/IT Incident affecting 92,795 individuals. An employee was the victim of an email phishing attack exposing ePHI stored in email, including names, addresses, dates of birth, driver's license numbers, Social Security numbers, health insurance information, and treatment information. The CE notified HHS, affected individuals, and media, offered credit monitoring, implemented additional technical safeguards, and retrained staff on phishing awareness. OCR obtained assurances of corrective action.

Mercy Iowa City reported a data breach to the Montana Attorney General. The breach was reported on 2020-10-03. The breach occurred from 5/15/2020 to 6/24/2020. 14 Montana residents were affected.

Mercy Iowa City (IA) reported to HHS on 2016-03-25 a Hacking/IT Incident (cyber-attack) affecting the ePHI of approximately 15,625 individuals. Breached information was located on Desktop Computer, Email, and Network Server. The CE notified HHS, affected individuals, and the media, provided substitute notice, and implemented additional technical safeguards and identity theft protection/credit monitoring services. OCR obtained assurances that corrective actions were implemented.