Merit Health Northwest Mississippi

An employee of Merit Health Northwest Mississippi, the covered entity (CE), impermissibly obtained protected health information (PHI) for identity theft and fraud purposes by photographing documents with a personal mobile device, writing patient information in a notebook, and removing paper medical records from the facility. After working with law enforcement and conducting an internal investigation, the CE determined that the stolen patient information included the names, dates of birth, addresses, social security numbers, medical record numbers, health insurance and clinical information of 847 individuals. The CE provided timely breach notification to HHS, to affected individuals and to the media. In addition, the CE offered free credit monitoring to the affected individuals and provided substitute notice on its website. In response to the breach, the CE re-trained its employees and revised its policy on the printing of social security numbers. The employee at fault for this incident is no longer employed by the CE. OCR obtained assurances that the CE has implemented the corrective actions listed above.