Virginia Commonwealth University Health System (VA) reported to HHS on 2017-03-10 an Unauthorized Access/Disclosure affecting 2,716 individuals via Electronic Medical Records. An employee of a community physician and an employee of a contracted vendor independently accessed patient records without a legitimate business need. PHI potentially viewed included full names, home addresses, dates of birth, medical record numbers, providers, visit dates, health insurance information, and diagnostic/treatment information. No malicious intent was confirmed and no data was retained. The CE implemented additional safeguards, removed browse functionality, and minimized search results. OCR obtained assurances of corrective action.
Affected (this filing): 2,716