Virtual Radiologic Professionals
Disclosed Dec 19, 20187 years ago2,568 affectedConfirmed
Virtual Radiologic Professionals (VRad), the covered entity (CE), reported that its vendor, MedData, a business associate (BA), experienced a programming error which caused the protected health information (PHI) of 846 individuals to be sent to the wrong recipients. When investigating this breach, MedData discovered that an additional programming error caused the PHI of 2,590 individuals to be entered into the incorrect billing records and also sent to the wrong recipients. VRad notified HHS, affected individuals, and the media. Substitute notice was also posted on its website. MedData revised its software to correct the errors. OCR provided technical assistance regarding vRad’s compliance obligations under the HIPAA Security Rule. As a result of OCR’s investigation, vRad developed and revised relevant procedures and developed an inventory of its business associates and its associated agreements. OCR obtained assurances that the aforementioned corrective actions were implemented.
What is known
| People affected | 2,568 (as reported to HHS) |
|---|---|
| Disclosed | Dec 19, 2018 |
| Attack | Insider |
| Data exposed | Names, Health |
| Sector | Healthcare · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| HHS OCR breach report (archive, resolved): Virtual Radiologic Professionals (Healthcare Provider, MN)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Dec 19, 2018 | 2,568 |
| HHS archivetotal | Dec 19, 2018 | 846 |
History of this record
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (HHS archive), confirmed by HHS OCR. Record counts are as reported. Not legal advice.