HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 14, 2014.
- Organization as reported
- Valley View Hospital Association, CO
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Laptop
- Submission date
- March 14, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15150, row:6289)
- Archived copy
- Held in the private archive (provenance)
On January 25, 2014, Valley View Hospital Association, the covered entity (CE), discovered that malware infected 172 of its computer workstations. The CE determined that, on 90 of the 172 infected workstations, the malware took screen shots of the electronic protected health information (ePHI) belonging to 5,415 individuals, and the malware stored those screen shots as encrypted files “hidden” on the workstations’ hard drives. The screen shots contained names, social security numbers, and other demographic information as well as credit card information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE deployed anti-virus software and cleaned the malware from its systems. OCR’s investigation resulted in the CE revising its procedures for safeguarding ePHI and protecting against malicious software. OCR provided technical assistance to the CE regarding the Security Rule’s risk analysis and risk management requirements. OCR also obtained an assurance from the CE that it would update its risk analysis and risk management plan.