Portland VA Medical Center

An employee of the covered entity (CE), Veterans Health Administration Portland VA Medical Center, took home paper lists of patients’ protected health information (PHI) to work on over the weekend and forgot to return the information. The employee’s husband subsequently found the lists in their garage six months later. The lists included names, social security numbers, provider names, eligibility codes, and diagnostic, clinical and demographic information for about 1,740 individuals. The employee’s husband who found the lists returned the PHI and signed a statement that he made no copies of the documents and that he knew of no others that had viewed the lists. The CE retrained the employee who took the lists home. The CE provided breach notification to HHS, the media, and affected individuals, and offered free credit monitoring for a year. OCR’s investigation confirmed that the CE took the corrective action steps listed and provided substitute notification.