HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 16, 2014.
- Organization as reported
- Sentara Healthcare, VA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft, Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Jan. 16, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15200, row:6339)
- Archived copy
- Held in the private archive (provenance)
Two former employees of the covered entity (CE), Sentara Healthcare, accessed protected health information (PHI) outside of their normal job duties and used this information to process fraudulent tax returns. The US Attorney’s office investigated the matter and both individuals received prison sentences. The breach report indicated that the PHI of approximately 3,645 individuals was involved in the breach; however, the CE verified that the final count of affected individuals was 3,891. The CE provided breach notification to HHS, affected individuals, and the media. The CE also offered complimentary credit monitoring and identity theft protection services to all eligible individuals. Following this incident, the CE increased safeguards by installing a new software system to help monitor and detect inappropriate access to its electronic medical records system, updated its security policies and procedures, re-trained employees, and initiated steps to address and mitigate the issues identified in its 2014 risk analysis. OCR obtained assurances that the corrective actions listed above were completed and/or initiated as described.