VCU Health System

The covered entity (CE) reported that from January 3, 2003, through May 10, 2018, a staff member accessed the protected health information (PHI) of 4,686 individuals without a legitimate business reason and that two other employees were aware, but did not report it. The types of PHI involved in the breach included demographic, financial, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE increased safeguards by monitoring all user access and setting alerts for certain types of access. The CE sanctioned the employee who accessed the records without a business need along with the two employees who knew of the inappropriate access and failed to report it, which in this case included termination of employment for all three. OCR obtained assurances that the CE retrained its entire workforce on its policies and procedures.