6 DEPARTMENT or HEALTH HUMAN Of?ce ofthe Secretary ?5 a ?the Voice - (404) 562-7836, (300} sea-101a Of?ce for Civil Rights. Region or TDD - (404) 552?7334. (soc) 532369? Atlanta Federal Center Fax - (404) 562-7331 61 at, sw, . Suite 18T70 Atlanta GA 30393 November 29, 201 1 {bienbitctci VHA Information Access and Privacy Of?ce Attn: Andrea Wilson, CIPPIG VHA Privacy Specialist - Department of Veterans Affairs 810 Vermont Ave, NW. (10P2C) Washington, DC. 20420 RE: {bli?libllillcl . Miami VA Healthcare stem erence number: 11-132038 {bli?libliiltcl Dear and Ms. Wilson: On September I3, 2011, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, .C, and E, the Privacy and Security Rules). Speci?cally, the complaint alleges that Miami VA Healthcare System denied request to amend his medical records. This allegation could re?ect a violation of 45 CPR. 164.526. OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On November 22, 2011, OCR asked the VHA Information Access and Privacy Office (VHA) to provide certain information and documents reiatin to the allegation in the complaint. OCR obtained a copy of the letter denying the uest and the denial did not comply With the Privacy Rule. VHA told OCR that it denied {bli?ilibliilicl equest in accordance with the Privacy Act, which also governs medical records maintained by VI-IA. OCR informed VHA that, even if it is subject to the Privacy Act, it still must conform to the Privacy Rule. ?Some federal agencies . . . that are covered entities under the Privacy Rule are subject to the Privacy Act. These entities must comply with all applicable federal statutes and regulations.? Standards for Privacy of Individually Identifiable Health Information, 64 Fed. Reg. 82462, 82482 (Dec. 28, 2000}. OCR provided technical assistance on requests for amendments under the Privacy Rule. See 45 C.F.R. 164.526. OCR also informed VHA that requests for amendments can be denied if the records ?would not be available for inspection under 164.524.? 45 CFR. OCR informed VHA that under 164.524, a request to inspect records can be denied if ?the records are ?subject to the Privacy Act, . . . if the denial of access under the Privacy Act would meet the requirements of that law.? 45 CPR. Thus, OCR informed VHA that the Privacy Rule may also defer to the Privacy Act on requests for amendment. VHA agreed to assess {biielibilii'ici request under both the Privacy Rule and the Privacy Act. On November 29, 201 l, VHA sent OCR a copy of a new letter to The letter says his request ?was denied because it was determined that the information contained in the progress note was accurate, complete, and relevant in its current form.? The Privacy Rule permits covered entities to deny requests for amendments if it determines the records are ?accurate and complete." 45 C.F.R. The letter included all of the other information required by the Privacy Rule, including information on apealing the decision and submitting a ?statement of disagreement? for inclusion in Immublmm medical records. VHA informed OCR that Egif?iiblm appeal is currently pending before its Of?ce of General Counsel. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary cort of VHA Information Access and Privacy Of?ce. Although VHA did not reject 3 amendment request in accordance with the Privacy Rule, it sent ?(53mm . revised denial which does conform to the Privacy Rule. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. OCR only reviewed the evidence submitted pertinent to resolving the issue raised in the complaint. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact William Corriher, Investigator, at (404) 562-7523 (Voice), (404) Sincerely yours, osevel Freeman Regional Manager 9 0 it. DEPARTMENT OF HEALTH 8: HUMAN SERVICES O?ic? (lithe Sacra-tart . amen Voice - (404} 562-7386. (800} 363-1019 Of?ce for Civil Rights, Region IV TDD (404) 552-7334. {800} 537-?697 I Atlanta Federal Center Fax - (454} 5624331 or St, sw. Suite 16T70 Mania, 30303 November 29, 201 1 VHA Information Access and Privacy Of?ce Attn: Andrea Wilson, CIPPIG VHA Privacy Specialist Department of Veterans Affairs 810 Vermont Ave, N.W. (10P2C) Washington, DC. 20420 RE: v. Miami 1lr?AHealthcareS stern Reference number: i 1-132033 Dear 311d MS. On September 13, 2011, the US. Department of Health and Human Services (HI-IS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy I of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health lnforrnation (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Securi Rules . Speci?cally, the complaint alleges that Miami VA Healthcare System denied equest to amend his medical records. This allegation could re?ect a violation of 45 164.526. OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On November 22, 2011, OCR asked the VHA Information Access and Privacy Of?ce (VHA) to provide certain information and documents reiatin to the allegation in the complaint. OCR obtained a copy of the letter to {blieliblmicl idenying the uest, and the denial did not comply with the Privacy Rule. VHA told OCR that it denied Eequest in accordance with the Privacy Act, which also governs medical records mantarne A. OCR informed VHA that, even if it is subject to the Privacy Act, it still must conform to the Privacy Rule. ?Some federal agencies . . . that are covered entities under the Privacy Rule are subject to the Privacy Act. These entities must comply with all applicable federal statutes and regulations." Standards for - Privacy of Individually Identi?able Health Information, 64 Fed. Reg. 82462, 82482 (Dec. 28, 2000). OCR provided technical assistance on requests for amendments under the Privacy Rule. See 45 C.F.R. 164.526. OCR also informed VHA that requests for amendments can be denied if the records ?would not be available for inspection under 164.524.? 45 C.F.R. OCR informed VHA that under 164.524, a request to inspect records can be denied if ?the records are ?subject to the Privacy Act, . . . if the denial of access under the Privacy Act would meet the requirements of that law.? 45 C.F.R. Thus, OCR informed VHA that the Privacy Rule may also defer to the Privacy Act on requests for amendment. VHA agreed to assess equest under both the Privac Rule and the Privacy Act. On November 29, 2011, VHA sent OCR a copy of a new letter to The letter says his request ?was denied because it was determined that the information con . ned in the progress note was accurate, complete, and relevant in its current form.? The Privacy Rule permits covered entities to deny requests for amendments if it determines the records are ?accurate and complete.? 45 C.F.R. The letter included all of the other information required by the Privacy Rule, including information on apealing the decision and submitting a ?statement of cut? for inclusion in medical records. VHA informed OCR that {bl (melon?) . . . {Bitb ppeal is currently pending before its Of?ce of General Counsel. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of VHA Information Access and Privacy Office. Although - a did not reject amendment request in accordance with the Privacy Rule, it sent a revise I enia ich does conform to the Privacy Rule. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. OCR only reviewed the evidence submitted pertinent to resolving the issue raised in the complaint. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact William Corriher, Investigator, at (404) 56247523 (Voice), (404) Sincerely yours, 0 Roosevelt reeman Regional Manager