emu.
a? ?s


as!? 

DEPARTMENT OF HEALTH HUMAN SERVICES OFFICE OF THE SECRETARY
Voice - (215) 361-4441, (215} 861-4440
(FAX) - (215] 551?4431 Of?ce for Civil Rights, Region 
150 S. Independence Mall West

Public Ledger Building, Suite 372
Philadelphia, PA 19106-9111

November 15, 201]

TRICARE

{Dimming TMA Privacy and Civil Liberties Of?ce
skyline Five, Ste. 810

511] Leesburg Pike

Falls Church, VA 22041

 

 

 

 

 

{bHBJin?t'llcl

 

 

 

Transaction number: 1 1-1292] 1

 

Dear 

 

 

 

On June 28, 2010, the Department of Health and Human Services (HHS), Of?ce for Civil Rights
(OCR) received a complaint alleging that the DeWitt Health Care Nehvork

is not in compliance with the Federal standards for privacy of individually identi?able health
information and/or the Security Standards for the Protection of Electronic Protected Health
Information (45 CPR. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security
Rules). Speci?cally, alleges that his ex-wife impermissiny obtained his new wife
and her childrens' e1 er through the Family Health Center or through TRICARE without
obtaining consent or authorization. Such allegations could re?ect a violation of 45 C.F.R.
?164.502(a) regarding the impermissible disclosure of protected health information, as well as 45
?164.530(c) regarding safeguards.

OCR enforces the Privacy Rule, and also enforces Federal civil rights laws which prohibit
discrimination in the delivery of health and human services because of race, color, national
origin, disability, age, and under certain circumstances, sex and religion.

On August 16, 2011, OCR noti?ed TRICARE of the complaint.

We have reviewed the matters raised in the complaint. TRICARE provided OCR with the
following information: The local HIPAA Privacy O?ce?s investigation determined the
Complainant?s allegation regarding the impermissible use and disclosure of both his and his
current wife?s PHI by his ex-wife to be substantiated. An audit determined that the

Complainant?s ex-wife impermissiny accessed the protected health
information of the complainant and his wife on multiple occasions ?nm April 1 1, 2011 tln'ough
August 22, 2011. As a result of such impermissible use and disclosure of protected health
information,W was terminated. Furthermore, TRICARE informed OCR that a letter

 

 

Page 2

of apology was provided to the complainant and the incident was properly reported as a breach
with OCR.

Additionally, it was recommended that all employees? pro?les at DeWitt be veri?ed to ensure
that they only have necessary security keys to perform their authorized job duties.

All matters raised by this complaint at the time it was ?led have now been resolved through the
voluntary compliance actions of TRICARE. Therefore, OCR is closing this case.

detemn'nation as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR. 

Under the Freedom of Information Act, we may be required to release this letter and other
information about this case upon request by the public. In the event OCR receives such a request,
we will make every effort, as permitted by law, to protect information that identifies individuals
or thar, if released, could constitute a clearly unwarranted invasion of personal privacy.

If you have any questions, please contact Amy Kaplan, at (215) 361-4446.

Sincerely,

Marlene L. Rey 4

Acting Regional Manager