HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 26, 2015.
- Organization as reported
- Merit Health Northwest Mississippi, MS
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Electronic Medical Record
- Submission date
- Aug. 26, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14722, row:5861)
- Archived copy
- Held in the private archive (provenance)
An employee of Merit Health Northwest Mississippi, the covered entity (CE), impermissibly obtained protected health information (PHI) for identity theft and fraud purposes by photographing documents with a personal mobile device, writing patient information in a notebook, and removing paper medical records from the facility. After working with law enforcement and conducting an internal investigation, the CE determined that the stolen patient information included the names, dates of birth, addresses, social security numbers, medical record numbers, health insurance and clinical information of 847 individuals. The CE provided timely breach notification to HHS, to affected individuals and to the media. In addition, the CE offered free credit monitoring to the affected individuals and provided substitute notice on its website. In response to the breach, the CE re-trained its employees and revised its policy on the printing of social security numbers. The employee at fault for this incident is no longer employed by the CE. OCR obtained assurances that the CE has implemented the corrective actions listed above.