Mercy Hospital, Iowa City, Iowa

Mercy Iowa City, a healthcare provider, reported an external system breach (hacking) occurring on May 15, 2020, discovered on October 3, 2020. The incident affected 92,795 individuals, including 5 Maine residents. Compromised data included names and Social Security Numbers. The entity notified affected individuals in writing on November 13, 2020, and offered one year of identity theft protection services.

Affected (this filing): 92,795

Mercy Iowa City (IA) reported to HHS OCR on 2020-11-13 a Hacking/IT Incident affecting 92,795 individuals. An employee was the victim of an email phishing attack exposing ePHI stored in email, including names, addresses, dates of birth, driver's license numbers, Social Security numbers, health insurance information, and treatment information. The CE notified HHS, affected individuals, and media, offered credit monitoring, implemented additional technical safeguards, and retrained staff on phishing awareness. OCR obtained assurances of corrective action.

Affected (this filing): 92,795