HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of March 11, 2016.
- Organization as reported
- Virtua Medical Group, NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server, Other
- Submission date
- March 11, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14588, row:5727)
- Archived copy
- Held in the private archive (provenance)
Virtua Medical Group, the covered entity (CE), reported a breach by its transcription vendor when the business associate unintentionally misconfigured its server leading to exposure of the transcription documents via an internet search engine. The CE estimated the transcription documents may have included the electronic protected health information (ePHI) of 1,654 patients’ names, birthdates and treatment information from office visits. The CE provided breach notification to HHS, the media, and the affected individuals, and posted notice to its website. As a result of OCR’s investigation, the CE contacted law enforcement, and contacted the transcription vendor to facilitate the removal of the entire site at issue from Google cache. The CE received assurances that Google removed the individual patient records that were accessible via searching the internet and that no other search engine was involved. The CE also terminated its relationship with the transcription vendor. Additionally, the CE is expected to take additional corrective actions in connection with the consent judgment entered into by CE with the Attorney General of the State of New Jersey and the New Jersey Division of Consumer Affairs.