DEPARTMENT OF HEALTH d: HUMAN SERVICES

OFFICE OF THE SECRETARY

 

Voice? (215) 351-4441
TDD (215} 351-4440
at, Fax- {215) 861-4431

imp; mgpviggr

Of?ce for Civil Rights, Region 
150 S. Independence Hall West
Public Ledger Building, Suite 322
Philadelphia, PA 19105-3499

 

Reference: 12-139498
Investigator: Amy Kapian
Contact Telephone: 215-361-4445

February 25, 2013

'Lbiif?libil?ilUJ . . . . .
Director, Privacy and Civil Liberties Office

TRICARE Management Activity
Skyline 5, Suite

5111 Leesburg Pike

Falls Church VA 22041

 

{bil?iibilTIlC-i

 

 

 

 

Dear 

 

 

 

On February 12, 2012, the Department of Health and Human Services (HHS), Office for Civil
Rights (OCR) received a complaint alleging that a Command?s Medical Administration Officer
of the USS Enterprise (CVN 65) is not in compliance with the Federal standards for privacy of
individually identi?able health information andfor the Security Standards for the Protection of
Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts C, and E, the

 

Privacy and Security Rules). Speci?cally, alleged 

impermissiny accessed the Complainant?s protected health information after her husband ?led a
special request chit. This allegation could re?ect a violation of 45 CPR. regarding
impennissible uses and disclosures of protected health information and or, regarding

safeguards.

OCR enforces the Privacy Rule, and also enforces Federal civil rights laws which prohibit
discrimination in the delivery of health and human services because of race, color, national
origin, disability, age, and under certain circumstances, sex and religion.

011 October 2, 2012, OCR noti?ed Tricare of the complaint.

We have reviewed the matters raised in the complaint. Trieste provided OCR with written
assurance of the following: Upon receipt of this complaint, Tricare indicated that they
coordinated an investigation with the Of?ce of the Chief, Bureau of Medicine and Surgery,
United States Navy. They stated that the local HIPAA Privacy Of?ce?s investi tion determined
the Complainant?s allegation to be substantiated. An access audit of {Emmi-?03m: electronic
medical records con?rmed that I impennissibly accessed the
Complainant?s protected health information on January 24, 2012. The investigation found

 

 

 

 

 

that {mimime as attempting to verify husband?s special requat chit in an
inappropriate manner. Tricare noted that as a result of this ?nding, CW 65 took the appropriate
mitigation and sanction actions, including administrative counseling and department-wide
HIPAA training. Tricare noted that an apology will be provided by the Navy to the Complainant.

 

In addition, Tricare noted that the covered entity, CVN 65 has been decommissioned and is no
longer in service. As such, the conunand and personnel are no longer part of this covered entity.
Nevertheless, Tricare assured OCR they take security and privacy of their bene?ciaries?
information very seriously and will continue to train Medical Health System employees on the
applicable privacy and security policies.

All matters raised by this complaint at the time it was ?led have now been resolved through the
voluntary compliance actions of Tricare. Therefore, OCR is closing this case.

determination as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR

Under the Freedom of Information Act, we may be required to release this letter and other
information about this case upon request by the public. In the event OCR receives such a request,

we will make every effort, as permitted by law, to protect information that identi?es individuals
or that, if released, could constitute a clearly unwarranted invasion of personal privacy.

If you have any questions, please contact Amy Kaplan, at (215) 361-4446.

Sincerely,

Barbara J. Hollan
Regional Manager