On February 28, 2025, Mayo Clinic learned that research data containing limited Protected Health Information (PHI) related to the use of magnetic resonance elastography (MRE) in liver and surgical outcomes in patients with type 2 diabetes and fatty liver was sent in violation of Mayo Clinic policies; a researcher sent the information to their personal email.

Mayo Clinic is deeply committed to protecting patient privacy and maintaining the highest standards of data security. Accordingly, Mayo Clinic attempted to contact the 1,869 affected patients by letter. Because a number of letters were returned as undeliverable, Mayo Clinic is providing this substitute notice. Information to contact Mayo Clinic to determine if you were affected by this incident is provided below.

Please note that the data did not include patient names, addresses, or other directly identifying information. Because names, dates of birth, social security numbers or financial information were not accessed, shared or misused, we are not recommending that affected patients take any action.

Frequently asked questions

What happened?

On February 28, 2025, Mayo Clinic learned that a researcher at Mayo Clinic sent study information that included Protected Heath Information (PHI) to their personal email address originating in China. The information was shared with six other people who are not affiliated with Mayo Clinic. Mayo Clinic worked with the researcher to request the data be permanently deleted.

What personal information was shared?

The data sent included Mayo Clinic medical record numbers, information about diagnoses and dates of service. As noted above, name, address and other directly identifying information was not included in the data.

How many patients were affected?

1,869 patients involved in a liver study were affected.

How do I know if I was affected?

Mayo Clinic attempted to contact the affected patients by letter. Because a number of letters were returned as undeliverable, Mayo Clinic is providing this substitute notice.

Those affected were part of a research study related to the use of magnetic resonance elastography (MRE) in the liver and surgical outcomes in patients with type 2 diabetes and fatty liver. If you were, or are, a participant and did not receive a letter in the mail, you may contact the Privacy Office at privacyoffice@mayo.edu or by phone at: 844-681-7087 and refer to incident number PE-15071.

What has Mayo Clinic done?

Mayo Clinic is deeply committed to protecting the privacy of our patients, and we sincerely regret this incident. We take this matter very seriously. The Privacy team worked with the research team to find ways to ensure information was deleted and not further shared. We continue to review the training provided to researchers to ensure appropriate education. We also continue to enhance our existing technological tools to detect and block data from being sent to personal email addresses.

Mayo Clinic further took appropriate corrective actions for the individual that shared this information as it is a violation of the applicable law and our policies. The individual is no longer affiliated with Mayo Clinic.

April 22, 2025

Original article: https://www.mayoclinic.org/es-es/limited-disclosure-patient-information