Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
VA Southeast Network (VISN 7)
Mentioned in a privacy incident report created by the U.S. Department of Veterans Affairs on March 7, 2012. Also cited in 225 other reports.
Report ID: SPE000000072600, U.S. Department of Veterans Affairs
Reported Entity: VISN 07 Decatur, GA
Issue:
A Social Worker (SW) was training the staff at the Henderson Mill Annex including the Program Support Assistants (PSA) on how to read a spreadsheet so that they could make appointments according to the protocol. All staff in the meeting had access to the spreadsheet because they either saw patients on the list or made follow up appointments for them. The Social Worker did not know that one of the employees, a PSA, in the training was also a patient and she had him listed on the spreadsheet with the other patients. The information on the spreadsheet included the PSA's last name, first initial, and protected health information (PHI) including clinic name, dates of appointments.After the training the PSA employee/patient sent many emails to staff making them aware of the spreadsheet and his name being contained there. The SW and Mental Health (MH) Management apologized to the PSA and removed this type of information from the training format. Update: 03/08/12:Employee A will be sent a notification letter.
Outcome:
Service training on the new appointment scheduling will be continued without the inclusion of patient information. Section leaders will be given feedback regarding the overall performance of their sections as a whole instead of discussing individual patients. Social Worker will retake the VHA Privacy Policy Trng and read and confirm VA Directive 6511 Transmittal Sheet. Staff have been educated regarding this process.