Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
VA Great Lakes Health Care System (VISN 12)
Mentioned in a privacy incident report created by the U.S. Department of Veterans Affairs on October 17, 2011. Also cited in 130 other reports.
Report ID: SPE000000067744, U.S. Department of Veterans Affairs
Reported Entity: VISN 12 Milwaukee, WI
Issue:
The complainant, who is a Veteran and a VA employee, alleges that the Women's Veterans Program Coordinator for the Milwaukee VAMC, called the complainant's mother (also VA employee) and asked the complainant's mother if a person with a name identical to the complainant's name who had recently had an elective surgery was her daughter. Update: 10/18/11:The Women's Veterans Program Coordinator has denied looking into the daughter's chart for any reasons other than her official duties. She has accessed the record and added clinical notes. The Coordinator also denies calling the complaintant's mother as noted in the complaint. The complaintant's mother states the Coordinator did call her.10/21/11:The investigation reveals there is a possibility that this happened and there is no hard evidence to disprove the claims of the daughter and the mother against the Women's Veterans Program Coordinator. To err on the side of caution, a HIPAA notification letter will be sent to the daughter/VA employee.
Outcome:
I informed the VAMC Director of the results of the investigation that a privacy breach likely did occur here. The Director has been out all this week and possibly next week, so he asked that I brief the Chief of Staff on this. The employees supervisor is out at one of the CBOCs today, so I will not be able to discuss this incident until Monday (likely in the afternoon). The Director did instruct me to remind the employees supervisor that there is an expectation of accountability for this incident. It is likely that there will be disciplinary action taken, though what that action will be is not clear at this time. I will be conducting individual privacy training with the employee.