HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of July 6, 2018.
- Organization as reported
- VCU Health System, VA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- July 6, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13762, row:4901)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE) reported that from January 3, 2003, through May 10, 2018, a staff member accessed the protected health information (PHI) of 4,686 individuals without a legitimate business reason and that two other employees were aware, but did not report it. The types of PHI involved in the breach included demographic, financial, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE increased safeguards by monitoring all user access and setting alerts for certain types of access. The CE sanctioned the employee who accessed the records without a business need along with the two employees who knew of the inappropriate access and failed to report it, which in this case included termination of employment for all three. OCR obtained assurances that the CE retrained its entire workforce on its policies and procedures.