VCU Health System is in the process of notifying about 4,700 individuals that their or their child’s electronic health information was inappropriately accessed by a former employee.
Following an investigation and review of access audit logs, the health system confirmed that an employee accessed, without legitimate business reasons, information about patients and services they received at the VCU Health System. As a result of this incident, the employee has been terminated.
There is no indication that the private health information has been or will be used for any malicious purposes. The matter came to light on May 9th, when an unusual pattern of accessing electronic health information was detected.
The inappropriate access happened generally during the employee’s employment between January 3rd of 2003 and May 10th of 2018. The investigation indicated the electronic health information was viewed without malicious intent.
Information that may have been viewed includes the patients’ full names, home addresses, dates of birth, medical record numbers, health care providers, visit dates, health insurance information, and other medical information. In some instances, Social Security numbers also could have been viewed.
VCU Health System is staffing a toll-free line for patient questions at (877) 846-9080, Mondays through Fridays, from 9:00 AM until 9:00 PM and the health system also is providing one year of free credit monitoring and identity theft protection services to assist patients whose Social Security numbers were accessed.