HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 6, 2018.
- Organization as reported
- Veterans Health Administration, DC
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- Nov. 6, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13638, row:4777)
- Archived copy
- Held in the private archive (provenance)
On August 8, 2018, and September 4, 2018, the covered entity's (CE’s) business associate (BA), Xerox Corporation, erroneously printed appointment reminder cards for patients that were mailed to another patient. The two incidents affected a total of 19,254 individuals and included demographic and clinical information. The CE/BA provided breach notification to HHS, affected individuals, and the media. To protect against any other printing misalignment incident, the BA instituted additional processes and preventative measures such as joint BA and CE review of templates and programming prior to printing and a match alert notification. OCR reviewed a copy of the BA agreement, the individual breach notification letter, as well as the security measures implemented to address risks and vulnerabilities. OCR obtained assurances that the CE implemented the corrective actions listed.