Virginia Commonwealth University Health System Authority

Virginia Commonwealth University Health System reported to HHS on 2022-05-27 a Unauthorized Access/Disclosure affecting 4441 individuals. Breached information located on Electronic Medical Record. A technical issue with a new EMR system and patient portal caused PHI (names, SSNs, birthdates, lab results) to be misdirected to wrong recipients. The CE provided credit monitoring and implemented additional safeguards.

VIRGINIA COMMONWEALTH UNIVERSITY HEALTH SYSTEM filed a data-breach notice with the Illinois Attorney General during 2022 (case 2022-361). The register records the breach as discovered on October 17, 2017. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

VIRGINIA COMMONWEALTH UNIVERSITY HEALTH SYSTEM filed a data-breach notice with the Illinois Attorney General during 2022 (case 2022-423). The register records the breach as discovered on May 27, 2022. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Virginia Commonwealth University Health System (VCUHS) notified the NH AG of a programmatic error in its intranet Healthcare Provider Database. From 2008 to March 2, 2020, a resident's Social Security number was visible in a field labeled 'Resident Primer License.' Discovered Feb 29, 2020, the error was corrected. One NH resident affected. No evidence of misuse. VCUHS offered credit monitoring and fraud alert guidance.

Virginia Commonwealth University Health System reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2020-03-31. 15 Massachusetts residents were affected. The report records the breach type as electronic.

Virginia Commonwealth University Health System (VA) reported to HHS on 2017-03-10 an Unauthorized Access/Disclosure affecting 2,716 individuals via Electronic Medical Records. An employee of a community physician and an employee of a contracted vendor independently accessed patient records without a legitimate business need. PHI potentially viewed included full names, home addresses, dates of birth, medical record numbers, providers, visit dates, health insurance information, and diagnostic/treatment information. No malicious intent was confirmed and no data was retained. The CE implemented additional safeguards, removed browse functionality, and minimized search results. OCR obtained assurances of corrective action.