run or? mm, - - DEPARTMENT OF HEALTH a HUMAN SERVICES OFFICE OF THE SECRETARY . Voice - (415) tar-331a (scones-1019 Grace for Civil Rights, Region I): Too . {soc} 537.759? 90 7" Street, Suite clan Id no," (415} 437-3329 San Francisco, California 94103 October 27, 2011 Ms. Andrea Wilson Privacy Implementation Coordinator Veterans Health Administration Privacy O?ice (l 0P2C l) 810 Vermont Avenue, NW. Washington DC, 20420 OCR Reference number: '11-126670 ena Ms. Wilson: On April 19, 201121- Human Services (HHS), Office for Civil Rights (OCR) received a complaint ?-om (The Complainant} alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Information (45 C.F.R. Parts 160 and 164, Subparts A and E, the Privacy Rule). Specifically, the complaint alleges that the Veterans Health I Administration (VI-1A) impermissiny disclosed Protected Health Information (PI-II) to Allstate Insurance Company (MC), the insurance company of a third part1?;r with whom The Complainant had been involved in an auto accident, without a valid au?torization. This allegation could re?ect violations of 45 CFR {$164,502. OCR enforces the Privacy Rule, and also enforces Federal. civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On July 1, 2011, OCR noti?ed of the complaint. On August 8, 201 l, OCR received initial response to the allegations. A summary of this response is provided below: I. concedes that it released information to AIC which exceeded the scope of the Complainant?s authorization . 2. VHA states that on January 22, 2011, it received a request from AIC'for ?Any and en documents pertaining to the examination, care, diagnosis, and treatment of the Regardless of date? 3. The workforce member who processed this request read the complainant?s authorization form, and con?rmed that The Complainant had authorized to disclose PHI to AIC. This workforce member noticed that The Complainant had limited his authorization to apply only to . PHI created after September 3, 200?. Unfortunately, this workforce member failed to read the proviso ?for accident related treatment only? which The Complainant had written next to the authorized time period. The workforce member consequently disclosed all PHI created during Page 2 1 1426670 this period. OCR received confirmation from VHA of voluntarily corrective action taken by VHA in order to address the concerns raised by the complainant. l. VHA provided verbal counseling to the workforce member responsible for the disclosure. The workforce member stated that this impermissible disclosure was unintentional, and that he regretted the mistake. 2. VHA provided retraining to the entire staff of the Release of Information Department on the - proper procedure for responding to 3?d party requests for patients? PHI. 3. VHA issued a formal letter of apology to the complainant, including information on how to proteot his identity, and an offer of one free year of credit monitoring. Based on the determination that an impermissible disclosure of PHI had occurred, OCR instructed VHA to conduct a risk assessment pursuant to 45 CFR Sec. 164.4020) to det?mine if this disclosure had resulted in a substantial risk to the complainant of financial, reputational or other harm. Based on this assessment VHA concluded that such a risk had been created by the impermissible disclosure and provided noti?cation of the breach to OCR as well as the Complainant. VHA also provided the complainant an opportunity to receive one year of free credit monitoring. OCR contacted the complainant on September 8, 2t)! 1, to con?rm his receipt of the letter of apology, and verify that he is satisfied with the result reached in this case. The Complainant expressed frustration that the mistake in this case resulted in a reduction of the damages award he was seeking in civil court. He also expressed frustration that a complaint he had previously ?led with the Office of Regional Counsel has been closed due to lack ofjurisdicticu. - We have reviewed the matters raised in the complaint. All matters raised by this complaint at the time it was filed have now been resolved through the voluntary compliance actions of the VHA. Therefore, OCR is, closing this case. determination as stated in this letter applies only to the allegations in the Privacy Rule complaint that were reviewed by OCR. Under the Freedom of lnfonnation Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Eric Press, Equal Opportunity Specialist, at (415) 437- 8321. Sincerely, .W, at ?9 Michael F. Kruley Regional Manager CC: Vicki Bowman