HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 10, 2014.
- Organization as reported
- Southwest Virginia Physicians for Women, VA
- Entity type as reported
- Healthcare Provider
- Category as reported
Theft, Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Oct. 10, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14955, row:6094)
- Archived copy
- Held in the private archive (provenance)
An employee’s husband, who was also a contractor of the covered entity (CE), Southwest Virginia Physicians for Women, stole protected health information (PHI) from its office, obtaining access to paper charts and other records. The PHI involved in the breach included clinical information affecting approximately 568 individuals. The CE, with the help of the Virginia State Police, retrieved the PHI the day after it was stolen. The CE provided breach notification to HHS, affected individuals, and the media, and posted substitute notification on its website. Following the breach, the CE transitioned from paper to electronic charts and updated its login, logoff, and password policies and procedures for authorized users of its online record management system. The CE also updated its policies regarding required business associate agreements. As a result of OCR’s investigation, the CE completed a risk analysis, implemented new physical security procedures, and retrained its staff regarding the changes