Mercy Hospital, Iowa City, Iowa

Mercy Iowa City notified the New Hampshire Attorney General of a phishing incident where an employee's email account was compromised from May 15, 2020, to June 24, 2020. The unauthorized party accessed personal information including names, SSNs, and medical/insurance data. Eight New Hampshire residents were affected. Mercy secured the account, engaged forensic investigators, and offered 12 months of credit monitoring.

Mercy Iowa City, a healthcare provider, reported an external system breach (hacking) occurring on May 15, 2020, discovered on October 3, 2020. The incident affected 92,795 individuals, including 5 Maine residents. Compromised data included names and Social Security Numbers. The entity notified affected individuals in writing on November 13, 2020, and offered one year of identity theft protection services.

Mercy Iowa City reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-11-13. 15 Massachusetts residents were affected. The report records the breach type as electronic.

Mercy Iowa City (IA) reported to HHS OCR on 2020-11-13 a Hacking/IT Incident affecting 92,795 individuals. An employee was the victim of an email phishing attack exposing ePHI stored in email, including names, addresses, dates of birth, driver's license numbers, Social Security numbers, health insurance information, and treatment information. The CE notified HHS, affected individuals, and media, offered credit monitoring, implemented additional technical safeguards, and retrained staff on phishing awareness. OCR obtained assurances of corrective action.

Erie Community College notified individuals of a data security incident where an unauthorized party accessed computer servers and workstations. The incident involved the exposure of Social Security numbers and driver's license numbers. ECC secured the systems, investigated, and offered one year of Experian IdentityWorks. The notification was sent on November 13, 2020.

MERCY IOWA CITY filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-480). The register records the breach as discovered on June 24, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Mercy Iowa City (IA) reported to HHS on 2016-03-25 a Hacking/IT Incident (cyber-attack) affecting the ePHI of approximately 15,625 individuals. Breached information was located on Desktop Computer, Email, and Network Server. The CE notified HHS, affected individuals, and the media, provided substitute notice, and implemented additional technical safeguards and identity theft protection/credit monitoring services. OCR obtained assurances that corrective actions were implemented.