The purpose of this notice is to inform patients who received services at Mercy Health (“Mercy”) medical facilities about a medical records privacy incident.
On October 7, 2020, Mercy learned that on one or more prior occasions, a Mercy employee accessed medical record information that was not needed by the employee for patient care purposes. The information accessed by the employee included names, addresses, dates of birth, other demographic information, medical record number, treatment and other clinical information and/or radiological images. For a very small number of individuals, health insurance identification numbers were accessed. Credit card numbers and other financial information were not accessed. Upon discovering the incident, Mercy immediately investigated the incident and made additional enhancements to procedures to prevent a similar incident from happening in the future. Additional education was provided to staff regarding compliance with the organization’s policies and procedures. The employee who accessed the information no longer works at Mercy.
As a precaution, all affected individuals are recommended to carefully monitor credit reports and billing and account statements for any unauthorized activity. It is also a good practice to remain vigilant for any phone calls or e-mails requesting personal information. Affected individuals may contact consumer reporting agencies to request that a fraud alert be placed on their credit report. In addition, out of an abundance of caution, all affected individuals are being offered identity theft protection services through IDX free of charge for one year.
If you have any questions or would like to learn additional information, please call a dedicated assistance line at 833-920-3176 Monday through Friday from 8 am to 8 pm Central Time. You may also submit any questions about this incident by mail directed to: Privacy Officer, Mercy, 14528 South Outer Forty Drive, Suite 100, Office 1036, Chesterfield, MO 63017.
