VCU Health System Accidentally Donates Patient Info to Art Project

Compact Discs containing sensitive medical and personal information were bequeathed for children’s activities.

“What began as a well-intentioned philanthropic effort by a staff member wanting to help turned into a serious mistake that we are working very hard to remedy,” said John Duval, chief executive officer of MCV Hospitals and Clinics. “This error brought to light a vulnerability in our system that developed over time and that we are working to correct, and we are deeply sorry for the inconvenience this may have caused some of our patients.”

The Virginia Commonwealth University Health System learned about the mistake on Oct. 15.

The hospital center mailed notification letters to potentially affected patients on Dec. 16.

From January 2012 through October of this year, CDs that were no longer needed for VCUHS services, some of which contained patient health information, were donated for children’s art projects.

The health system has retrieved “a significant number” of the donated CD, university officials said.

The discs contained the patient’s full name and at least one of the following: home address, date of birth, medical record number, clinical information (i.e., diagnosis, conditions, lab results, medications, and treatment information) and/or health insurance information.

“A limited number of compact discs also contained the patient’s Social Security number,” officials added.

To date, there is no evidence data has been misused.