HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 16, 2017.
- Organization as reported
- Sentara Healthcare, VA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Jan. 16, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14298, row:5437)
- Archived copy
- Held in the private archive (provenance)
On November 17, 2016, after receiving information from law enforcement, the covered entity (CE) determined that its business associate (BA), Medstreaming, experienced a cybersecurity incident impacting 5,454 records of vascular and thoracic patients seen at the CE between 2012 and 2015. The data may have contained demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Both the CE and the BA hired system forensic teams to look for exfiltration of data and evidence of inappropriate access to the system. The CE determined that the files contained PHI from other sources, suggesting that the breach came from an outside vendor. Despite this information, the CE rebuilt its Medstreaming platform, engaged a cybersecurity forensics firm to perform complete network compromise assessment, and improved technical safeguards, including monitoring the internet-facing cybersecurity posture of high-risk third party service providers and installing tools to block malware callback activity. OCR reviewed a copy of the BA Agreement, the notification of the breach to the affected individuals, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.