HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Jan. 7, 2015.
- Organization as reported
- VA Corporate Data Center Operations/Austin Information Technology Center, TX
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Jan. 7, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14906, row:6045)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Veterans Health Administration, discovered that its public facing telehealth website administered by one of its business associates (BA), AuthentiDate Holding Corporation, potentially impermissibly disclosed the protected health information (PHI) of 7,054 individuals. The types of PHI potentially involved in the breach included names, addresses, birthdates, phone numbers, and VA patient identification numbers of veterans who used the telehealth system. The CE provided breach notification to individuals, HHS, and the media, and also provided credit monitoring to the affected individuals. OCR verified that the CE had a proper BA agreement in place that restricted the BA’s use and disclosure of PHI and required the BA to safeguard all PHI. Upon discovery of the breach, the CE took steps to enforce the requirements of its BA agreement and determined not to renew the agreement with the identified BA. The CE reported that they are no longer doing business with the identified BA. OCR opened a separate case to review the BA’s compliance with the HIPAA Security Rule.