Mercy Medical Center Redding - Oncology Clinic

Mercy Medical Center Redding - Oncology Clinic reported to HHS on December 22, 2014, a breach affecting 616 individuals. The incident was caused by a business associate, Write-Type, Inc., which left electronic protected health information accessible on its website. The exposed data included names, addresses, medical record numbers, physicians’ names, and clinical information. The medical center has since revised its policies and procedures.

Mercy Medical Center Redding Oncology Clinic discovered on December 13, 2014, that transcribed physician progress notes containing patient demographic and treatment information (name, medical record number, date of birth, diagnosis, medications, etc.) were publicly accessible on a third-party website. The data covered services provided between June and October 2014. The third party removed the link upon discovery. No SSNs or financial information were involved. The organization is educating staff on securing medical information.