Mercy Health data breach: what happened and what to do

Mercy Health reported that an employee improperly accessed the health records of 11,187 people. HHS says the data included names, addresses, dates of birth, diagnoses, lab results and other treatment information. Mercy fired the employee and offered credit monitoring.

View all 13,177 breaches

Breach date: 7 Oct 2020
Made public: 4 Dec 2020
Affected: 11,187
Data exposed: Names, Physical addresses, Dates of birth, Medical information, Lab results, Treatment information
Last updated: 31 Oct 2026

Reviewed by Anthon Wansland

Head of Product & Co-Founder

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

What happened

Mercy Health reported to the U.S. Department of Health and Human Services (HHS) that an employee impermissibly accessed the protected health information of 11,187 people. This was not an outside hack: it was a staff member looking at records without a work reason.

HIPAA Journal reports that Mercy learned about it on October 7, 2020, and that the employee had accessed records on one or more earlier occasions. Mercy notified patients in December 2020.

Sources checked: hipaajournal.com, beckershospitalreview.com, ocrportal.hhs.gov

Last verified against the official page: 31 Oct 2026

How we research this Report an error

What was exposed

HHS lists names, addresses, dates of birth, diagnoses, lab results and other treatment information. HIPAA Journal adds that health insurance ID numbers appeared in some records, and that Mercy said credit card and other financial information was not accessed.

Because Social Security numbers aren't on that list, the main risk here is privacy and targeted scams, not new credit accounts. Someone who knows your diagnosis or your provider can write a believable message pretending to be your clinic or insurer.

What Mercy did

HHS says Mercy sanctioned the employee, offered affected people free credit monitoring and added technical safeguards. Becker's Hospital Review later reported that Mercy agreed to a $1.8 million settlement of a class action over the incident.

What to do if you were in it

1

Find out whether you were affected

Mercy notified patients by letter. If you were treated at Mercy Health and don't have one, ask the hospital's privacy office using the number on its official website.
2

Review your insurance statements

Read your health plan's explanation of benefits for services you didn't receive. If you see any, tell your insurer and report it at IdentityTheft.gov.
3

Take the free credit monitoring if it's offered

Use the enrollment code in your letter before its deadline. The FTC recommends accepting free credit monitoring after a breach.
4

Expect scams that use your health details

Don't act on a call, text or email about a bill, a prescription or your insurance, even if it knows your name or provider. Contact the organization using the number on your card or its official website.
5

Consider a credit freeze

Social Security numbers weren't listed, so this is optional. If you want the extra protection, the FTC says a freeze is free and you set it up at Equifax, Experian and TransUnion.
6

Check whether your email or phone is in this and other breaches

Run a free scan at serus.ai. It shows breaches that include your email or phone number and what to do about each one.

Official filings

U.S. Department of Health and Human Services , filed 4 Dec 2020 : 11,187 people

Timeline

7 Oct 2020
The breach happened
4 Dec 2020
The company made it public
4 Dec 2020
Reported to U.S. Department of Health and Human Services

Frequently asked

Was I affected by the Mercy Health data breach?

HHS lists 11,187 affected people. Mercy notified them in December 2020, so check for a letter or ask the hospital's privacy office.

What was exposed in the Mercy Health breach?

HHS lists names, addresses, dates of birth, diagnoses, lab results and other treatment information. Some records also had health insurance ID numbers.

Was this a hack?

No. According to HHS, an employee accessed records they had no work reason to see.

Is there a settlement?

Becker's Hospital Review reported that Mercy agreed to a $1.8 million settlement of a class action over the breach. Look for the official settlement notice for deadlines and eligibility.