McPherson Hospital mcphersonhospital.org McPherson Hospital data breach: what happened and what to do
McPherson Hospital in Kansas told HHS that a hacking incident exposed the health information of 19,020 people. HHS says it included names, dates of birth, Social Security numbers, diagnoses or conditions, lab results and medications. The hospital offered free credit monitoring.
View all 13,177 breaches- Breach date
- Jul 2022
- Made public
- 26 Sept 2022
- Affected
- 19,020
- Data exposed
- Names, Dates of birth, Social security numbers, Medical information, Lab results, Medications
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
McPherson Hospital, Inc. is a hospital in McPherson, Kansas. It reported to the U.S. Department of Health and Human Services (HHS) that it had a hacking incident affecting the protected health information of 19,020 people. TechTarget and HIPAA Journal both covered the filing.
HHS' description says the hospital notified HHS, the affected individuals and the media, and posted a substitute notice (a public notice on its website) for people who weren't notified directly.
Sources checked: techtarget.com, hipaajournal.com, ocrportal.hhs.gov
Last verified against the official page:
What was exposed
HHS lists names, dates of birth, Social Security numbers, diagnoses and conditions, lab results and medications. News coverage mentions additional items such as billing and insurance details.
The Social Security number and date of birth are the combination that matters most. With both, someone can apply for credit or file a fraudulent tax return in your name. Diagnoses and medications give scammers something specific to quote in a fake call from a clinic or pharmacy.
What the hospital did
According to HHS, the hospital offered affected people free credit monitoring, added administrative and technical safeguards, and retrained staff.
What to do if you were in it
- 1
Look for your notice letter
The hospital said it notified affected people by mail. If you were treated at McPherson Hospital and haven't seen a letter, call the hospital using the number on its official website and ask whether your records were included.
- 2
Freeze your credit at all three bureaus
A Social Security number was involved, so a credit freeze is the strongest step. The FTC says it's free and you place it separately at Equifax, Experian and TransUnion. If you'd rather not freeze, a fraud alert is a lighter option and lasts one year.
- 3
Take the free credit monitoring if it's offered
If your notice letter includes an enrollment code, use it before the deadline printed on the letter. The FTC recommends accepting free credit monitoring after a breach.
- 4
Watch for scams that mention the breach
Criminals use real breach details to sound legitimate. Don't act on a call, text or email about your account or bill, even if it knows your name. Contact the organization using a number from your letter or its official website.
- 5
Report identity theft if it happens
If someone opens an account in your name, report it at IdentityTheft.gov and follow the recovery plan the FTC builds for you.
- 6
Check whether your email or phone is in this and other breaches
Run a free scan at serus.ai. It shows breaches that include your email or phone number and what to do about each one. Serus can't remove data from a breach, but it alerts you when new exposures appear.
Official filings
- U.S. Department of Health and Human Services , filed 26 Sept 2022 : 19,020 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the McPherson Hospital data breach?
HHS lists 19,020 affected people. The hospital said it notified them by mail, so check for a letter or ask the hospital directly.
What was exposed in the McPherson Hospital breach?
HHS lists names, dates of birth, Social Security numbers, diagnoses and conditions, lab results and medications.
Does McPherson Hospital offer credit monitoring?
According to HHS, the hospital provided complimentary credit monitoring to affected individuals. Your letter has the enrollment details.
Should I freeze my credit after this breach?
If your Social Security number was in your notice, a freeze is the strongest step. The [FTC](https://consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts) explains how to place one for free.
Sources
- techtarget.com/healthtechsecurity/news/366594335/Healthcare-Data-Breach-At-Kansas-Hospital-Impacts-19K
- hipaajournal.com/data-breaches-reported-by-university-urology-and-mcpherson-hospital/
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
- identitytheft.gov
Something wrong or out of date? Tell us and we'll re-check it.
