An employee at Richmond-based Virginia Commonwealth University Health System accidentally donated compact discs storing protected health information to a children's art project from approximately January 2012 through October 2014.
According to the health system, the employee donated discs that were no longer needed for VCUHS services, some of which contained patient health information.
The health system launched an investigation to determine what information may have been contained on the discs, and in doing so has recollected "a significant number" of discs that were donated.
According to a Richmond Times-Dispatch report, approximately 1,000 medical records were compromised in this breach.
VCU Health System found no evidence indicating any of the patient information has been misused, according to the notice.
"What began as a well-intentioned philanthropic effort by a staff member wanting to help turned into a serious mistake that we are working very hard to remedy," said John Duval, CEO of MCV Hospitals and Clinics, in the notice. "This error brought to light a vulnerability in our system that developed over time and that we are working to correct, and we are deeply sorry for the inconvenience this may have caused some of our patients."
Regarding the employee who mistakenly donated the discs, Mr. Duval said in the Richmond Times-Dispatch report that any potential disciplinary action would remain a private personnel issue.
More articles on data breaches:
Illinois hospital blackmailed with release of patient data
Stolen laptop prompts data breach notification at Corvallis Clinic
Tribeca Medical Center reports data breach due to stolen records