HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 21, 2018.
- Organization as reported
- University of Virginia Medical Center, VA
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Laptop
- Submission date
- Feb. 21, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13917, row:5056)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), University of Virginia Medical Center, reported that an unauthorized third party may have been able to view 1,882 patients’ protected health information (PHI) on a physician's laptop computer and other devices from May 3, 2015, through December 27, 2016, by using malware. The FBI confirmed that the third party did not download files to his own machines and was apprehended. The types of PHI involved in the breach included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed a copy of the CE’s current risk assessment, as well as all policies and procedures concerning the issue at hand. Following the breach, the CE implemented additional safeguards for remote access to the CE’s health system network. OCR obtained assurances that the CE implemented the corrective actions listed.