Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
South Texas Veterans Health Care System
Mentioned in a privacy incident report created by the U.S. Department of Veterans Affairs on August 7, 2014. Also cited in 50 other reports.
Report ID: PSETS0000107619, U.S. Department of Veterans Affairs
Reported Entity: SOUTH TEXAS VETERANS - 671
Issue:
A Veteran contacted his Senator's Office stating a MyHealtheVet (MHV) email was sent from our facility showing all of the Veterans' email addresses the email was sent to. The email was informing the Veterans they have an upcoming appointment and they should go into MHV and upgrade their account from Basic to Premium. The Senator's Office contacted Public Affairs and they notified the Privacy Officer (PO) on 07/14/14. The PO contacted the MHV Coordinator. When the MHV Coordinator forwarded the email to the PO, it did not show any email addresses. Public Affairs contacted the Senator's Office and asked them to forward the email to this facility. They did not. The email forwarded to VA PO does have the email addresses listed, and in fact some of the names are listed multiple times. Addresses are listed as, i.e. firstname.last [email protected], other are listed as [email protected]. We are in the process of obtaining an accurate count and will update PSET with that number.
Outcome:
08/11/14: The PO confirmed that the original email contained the email addresses by contacting the MHV coordinator and calling one of the recipients of the email. After reviewing the email list, it appears out of 618 total email addresses, only 116 have the full name in the email address. 08/12/14: The Data Breach Core Team (DBCT) determined that although the VA Breach Risk Assessment Tool resulted in three High findings and one Low finding, the Low finding has more weight that the other three. There is a Low probability of risk of compromise and low risk of harm to the Veterans by disclosure of the email address.