BY JIM HALL

MediCorp Health System has offered hundreds of patients a free subscription to a credit-monitoring service after their private medical information was exposed online.

MediCorp, the parent company of Mary Washington Hospital, made the offer last week, nearly a month after patient data temporarily became available to the public.

Letters went to 760 people who had used the online registration system, said Mahogany Hart, spokeswoman for MediCorp. Many were maternity patients who had preregistered online for delivery of their babies at the Fredericksburg hospital.

Jina Haikey, MediCorp's privacy officer, told patients in the letter that the company has contracted with ID Experts, a computer security firm, to notify patients of any changes in their credit reports.

The one-year subscription is free to patients. It includes an insurance policy to cover certain losses, and help from a "recovery advocate" if patient data are misused.

Hart declined to say how much the offer will cost MediCorp. The bill will likely be in the thousands of dollars, depending on how many people accept it.

On its Web site, ID Experts sells a credit-watch family plan for $193.95 per year.

Rebecca Dennison, the person who first reported the security breach, said this week that she was surprised it took so long for MediCorp to respond. She received Haikey's letter last week.

"It makes it sound like they just heard about it," she said. "They've known about it for a month."

Dennison and her husband, Gary, live in Spotsylvania County and reported the problem to police on Oct. 11. Rebecca Dennison said she got a call that night from a stranger who said he was on the MediCorp Web site, reading personal information about her.

The man said later that when he went online to preregister his pregnant wife, he could read hundreds of files from other patients.

The man said 803 files were visible. The files appeared to be for people who had used the online registration service between Dec. 27, 2007, and Oct. 11, 2008, he said.

On a Web site set up by MediCorp and ID Experts, MediCorp explained the delay in notifying patients by saying that it took time to figure out what had happened and to decide what to do about it.