HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Feb. 24, 2017.
- Organization as reported
- Vanderbilt University Medical Center, TN
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- Feb. 24, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14260, row:5399)
- Archived copy
- Held in the private archive (provenance)
On December 27, 2016, Vanderbilt University Medical Center, the covered entity (CE), learned that a transporter employee in the Pediatric Emergency Department (PED) had accessed patients’ electronic medical records (EMR) without authorization. The breach involved the protected health information (PHI) of 3,247 individuals and included patients’ names, dates of birth, internal medical record numbers, clinical information, and for some records may have included social security numbers. In response to the breach, the CE sanctioned the involved employee (including termination in this case), reviewed its record audit procedures, removed EMR access for PED transporters, implemented an alternative process for PED transporters, and reviewed and edited its security policies. In addition, the CE provided retraining to departments utilizing a patient transport role. The CE provided breach notification to HHS, affected individuals, the media. OCR obtained assurances that the CE implemented the corrective actions listed above.