Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
South Central VA Health Care Network (VISN 16)
Mentioned in a privacy incident report created by the U.S. Department of Veterans Affairs on January 14, 2011. Also cited in 317 other reports.
Report ID: SPE000000057094, U.S. Department of Veterans Affairs
Reported Entity: VISN 16 Houston, TX
Issue:
The pharmacy Administrative Officer reported that her emergency call back "cascade" report has been stored on the Pharmacy's shared drive since 2005 and has been routinely updated as the employees' information changed. The report is used when it is necessary to call back employees in case of an emergency. The report is in an excel format and contained the employees' full name, full social security number, home address, and all contact telephone numbers. The document should have been placed in a secured folder with access restricted to supervisors and leads and not the entire department. The ISO is unable to determine how many of the employees actually accessed the report. The document has been relocated to a secure folder and the SSN has been removed. There were a total of 141 names on the form but 26 only had the employee's name and no other information. Update: 01/20/11:One hundred and fifteen employees will receive a letter offering credit protection services.
Outcome:
A broadcast message was sent to all medical center staff asking them to review all shared folders and files to which they currently have access. Staff were asked to ensure that they still need the access as part of their duties and if they do not need the access, to notify their supervisor. The SSN was removed from the cascade listing and the listing was placed in secure folder the can only be accessed by supervisors.