ms 5 QEEARIMEEI gr gnaw a mama g;ng Tim i, Voice (511) 555.1340, (soc) 363-1019, TDD {511) 565- 1343, (son) 531-1591 FAX {511) 555.3309, Of?ce for can Rights, Region 1 HR Federal Building, Room 1315 Government Center Boston, MA HHS-01132 (brainless) DEC 2 7 2911 Coordinator Privacy Investigations CVS Caremark One CVS Drive Woonsocket, RI 02895 {bili?llbl?licl Our Reference number: 11-123376 (sirens) {blt?libltiltcl Dear tract and On February 8, 2011, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, the complaint alleges that a pharmacy employee announced prescription information with other customers present. This allegation could re?ect a violation of 45 CPR. ?164.502(a) and OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On October 3, 2011, OCR noti?ed CVS Caremark of the complaint. CVS Caremark provided us with written assurance of the following: CVS received a complaint from complainant on behalf of his daughter on February 7, 2011. While CVS was unable to verify that prescription information had been impermissiny disclosed by an employee speaking loudly, CVS did retrain the pharmacy staff on appropriate oral commwications in the pharmacy area. CV8 also provided us with its policies for safeguarding of oral communication and uses and disclosures of protected health information. These policies appear to comply with the Privacy Rule. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of CVS Caremark. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that 1were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. lfyou have any questions, please contact Phil Lewis, Investigator, at 565-1355 (Voice), (617') 565-1343 (TDD). Sincerely, Peter K. Chan Regional Manager