HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of March 10, 2017.
- Organization as reported
- Virginia Commonwealth University Health System, VA
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Electronic Medical Record
- Submission date
- March 10, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14245, row:5384)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Virginia Commonwealth University Health System, detected an unusual pattern of accessing electronic patient records from two different sources and confirmed that an employee of a community physician and an employee with a contracted vendor, acting independently, accessed patient records without a legitimate business need. The types of protected health information (PHI) potentially viewed included full names, home addresses, dates of birth, medical record numbers, providers, visit dates, health insurance information and diagnostic and treatment information. As a result of this incident, the respective employers sanctioned the employees. The CE obtained assurances from the former employees that any inappropriate accesses to the electronic medical records were viewed without malicious intent and no information was retained. The CE implemented additional administrative and technical safeguards, eliminated the option to browse records, and limited the information that was displayed as the result of a search to the minimum necessary. The CE provided breach notification to HHS, the media, and affected individuals. OCR obtained assurances that the CE implemented the corrective actions listed.