Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
Atlanta VA Health Care System
Mentioned in a privacy incident report created by the U.S. Department of Veterans Affairs on April 14, 2015. Also cited in 15 other reports.
Report ID: PSETS0000118106, U.S. Department of Veterans Affairs
Reported Entity: DECATUR GA - 508
Issue:
The Privacy Officer (PO) was made aware of an incident where research participants received the letters of each other due to a mis-mailing. The Veterans received a letter at their address with the following protected health information (PHI) for a different Veteran: 1. Veterans first and last name 2. Veterans next of kins first and last name 3. Veterans primary care providers last name. In researching how this had occurred, the research team determined that it is possible that this affected 15 Veterans. All cases involved Veterans with the same last name. Our records indicate we had: 4 cases with 2 Veterans with the same last name = 8 Veterans 1 case with 3 Veterans with the same last name = 3 Veterans 1 case with 4 Veterans with the same last name = 4 Veterans In each of the 6 cases, a Veteran received a letter that was intended for another Veteran, and both Veterans had the same last name. This appears to be caused by an error in sorting data prior to initiating a mail merge. The PO will receive a list of the affected Veterans, a copy of the letters sent and an action plan.
Outcome:
04/15/15: The Incident Resolution Service Team has determined that Veteran B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.