511W: DEPARTMENT OF HEALTH 34 HIMAN SERVICES OFFICE OF THE SECRETARY ?s ff Voice (212) 254-3313. (800) 368-1019 Of?ce for Civil Rights, Region II "ream TDD (212) 264-2355. (600) 532?7697 Jacobo Javits Federal Building (FAX) - {212} 2643039 26 Federal Plaza, Suite 3312 goviocri New York! NY 10178 DEC 0 4 2012 Privacy Officer New York-PresbyterianNVeill Cornell Hospital 525 East asth Street, Box 10 New York, New York 10065 Our Reference number: 12-136080 Deartbiiotbimtci and (01511010113) On December 5, 2011, the US. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) received a complaint from (Complainant) alleging that the New York Presbyterian Hospital Cornell/Columbia (Covered Entity) was in violation of the Federal Standards for Privacy of Individually Identifiable Health Information and/or the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Specifically, the complaint alleges that the Covered Entity denied him an opportunity to inspect his medical records as requested on November 7, 2011. This allegation could reflect a violation of 45 C.F.R. access of individuals to protected health information (PHI). OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On January 6, 2012 OCR notified the Covered Entity ofthe complaint. We have reviewed the matter raised in the complaint and OCR spoke to the Complainant and the Covered Entity. OCR learned from the Complainant that on November 2011 he requested an opportunity to inspect his medical records and his request was denied. The Covered Entity informed OCR that although the Complainant provided a signed authorization form for access to his medical records on November 7, 2011, the manner in which he had written his request for access was unclear. The Covered Entity indicated that it believed that the Complainant?s request was for a copy of his records which were to be sent to his physician only. The Covered Entity informed OCR that after it became aware on December 5, 2011 that the Complainant wanted to inspect his medical records its workforce took several steps to arrange for the Complainant to review his records. The Covered Entity indicated that on December 21, 2011, it wrote an email to the Complainant, as per his instructions, inviting him to call the Privacy Officer to make appropriate arrangements for inspection of his records. The Covered Entity further indicated that after receiving the email the Complainant requested that the Covered Entity provide him with a written page 2 land [tbit?itbitiitCi letter regarding the invitation to inspect his medical records and a letter was sent to the Complainant on January 12,2012. On February 22, 2012, OCR spoke with the Complainant to determine if he received the Covered Entity's letter dated January 12, 2012. The Complainant informed OCR staff that he did not receive the letter. On February 24, 2012, the Covered Entity provided OCR with a copy of the delivery confirmation for the January 12, 2012 letter and informed OCR that the doorman at the apartment building confirmed that he gave the letter to the Complainant. On March 8, 2012, OCR learned that the Complainant called the Privacy Officer and left a message to request an opportunity to inspect his medical records. OCR learned that the Complainant and the Covered Entity agreed to meet on April 6, 2012 to inspect the records. The Covered Entity informed OCR on April 13, 2012 that the Complainant inspected his medical records on April 6, 2012 as agreed upon. All matters raised by this complaint at the time it was filed have now been resolved through the voluntary compliance actions of the covered entity. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identifies individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions or concerns regarding this matter, please contact Ms. Jenny lm, Investigator assigned to this complaint at (212) 264-4997. Thank you for bringing this matter to our a?en?on. Sincerely, ya a (if 1 Linda C. Colon Regional Manager Office for Civil Rights