West Virginia University Hospitals-East, Inc. DBA University Healthcare

The covered entity (CE), West Virginia University Hospitals- East, Inc., reported that on February 24, 2017, a police officer contacted its compliance officer indicating that 113 individuals had reported identity theft and it was discovered they had all been treated at Berkley Medical Center which is part of the CE. The breach affected 7,445 individuals and included demographic and clinical information. The CE discovered that an employee who handled these individuals during admission was involved in the breach. The employee, along with other individuals allegedly involved in the incident, was charged with identity theft, aggravated identity theft, bank fraud and producing false identity documents, among other charges, in a 36-count indictment handed down by a federal grand jury on June 20, 2017. A forensic review conducted by the CE’s third-party Incident Response vendor and the FBI immediately following the event determined that no PHI was removed or viewed from the CE’s electronic network. The CE provided OCR with its Kroll Event Report from June 2017, which provided an update and confirmation that there have been no additional reports of identity theft made to Kroll since the incident was identified and the criminal charges initiated. OCR reviewed a copy of the CE’s current risk assessment. The CE provided breach notification to HHS, affected individuals, and the media, and also provided free credit monitoring. OCR obtained assurances that the CE implemented the corrective actions listed above.