HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 29, 2014.
- Organization as reported
- Portland VA Medical Center, OR
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 29, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14945, row:6084)
- Archived copy
- Held in the private archive (provenance)
An employee of the covered entity (CE), Veterans Health Administration Portland VA Medical Center, took home paper lists of patients’ protected health information (PHI) to work on over the weekend and forgot to return the information. The employee’s husband subsequently found the lists in their garage six months later. The lists included names, social security numbers, provider names, eligibility codes, and diagnostic, clinical and demographic information for about 1,740 individuals. The employee’s husband who found the lists returned the PHI and signed a statement that he made no copies of the documents and that he knew of no others that had viewed the lists. The CE retrained the employee who took the lists home. The CE provided breach notification to HHS, the media, and affected individuals, and offered free credit monitoring for a year. OCR’s investigation confirmed that the CE took the corrective action steps listed and provided substitute notification.