UnityPoint Health says someone had unauthorized access to the personal records of about 1,800 patients.
A statement from the health care provider says the unidentified individual may have viewed names, insurance account numbers, as well as Social Security numbers and driver's license numbers.
Unity Point operates hospitals and clinics in Iowa and Illinois, including St.Luke's here in Sioux City.
Letters have been sent to affected patients about the security breach, which occurred between February and August.
Those patients will be offered a credit-monitoring service, and law enforcement is investigating the incident.
UnityPoint said the person who viewed the records was employed through a third-party and used other people's passwords to get into the electronic medical record system.