HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 8, 2016.
- Organization as reported
- VA Eastern Colorado Health Care System, CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Nov. 8, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14372, row:5511)
- Archived copy
- Held in the private archive (provenance)
On September 1, 2016, the Veteran’s Health Administration – Eastern Colorado Healthcare System, the covered entity (CE), discovered that one of its workforce members emailed a spreadsheet containing 2,130 veterans’ protected health information (PHI) to his personal email account and later published the PHI in a book on Amazon. The PHI included affected individuals’ full names, diagnoses, and the last four digits of their social security numbers. The Amazon book contained the personal telephone numbers for four individuals. Based on these breaches and OCR’s investigation, the CE provided breach notification to the affected individuals, the media, and HHS and offered credit monitoring and contact information for affected individuals with questions regarding the breach. In addition, the CE provided OCR with written assurance that it is notifying the four individuals whose PHI appeared in the Amazon-published book. The CE also investigated the incident and mitigated the effects of the breach by training the involved workforce member (prior to his resignation) and working with Amazon to remove the book from the retail website. During the investigation, OCR provided the CE with technical assistance regarding the “notification to individuals” section of the Breach Notification Rule and the risk assessment process for breach notification.