vim}. Mme DEPARTMENT OF HEAL J: HUM VICES OFFICE OF Tm Voice {ctr} 565-1340, {swim-1019. Ton {611) 565. 1343, {see} 5373691 Fax 565-3809, Of?ce for Civil Rights, Region I JFK Peder-I Building, Room 1815 Government Center Boston, MA mom 2013 {bli?ilbllill?l Compliance Otticer Dunlap Familyr Physicians 830 Main St. Orrville, OH 4466? {bli?ilbltil?l CVS Caremark 9501 E. Shea Blvd. MC 016 Scottsdale, AZ 35260 Our Reference number: 12?141 341 Deal. {bli?libliTItC-l and {bli?llblil?liCl On April 11, 2012, the U.S. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of individually Identi?able Health Information andfor the Security Standards for the Ptoteetion of Electronic Protected Health information (45 CPR. Parts 160 and i64, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, the complaint alleged that Carcmarlt is impermissiny disclosing patient protected health information (PHI) by sending the PHI to the wrong address. In addition, the complainant alleges that Careka has been unresponsive to her complaints. This allegation could re?ect violations 01?45 C.F.R. and reSpectively. OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On May 9, 2012, OCR noti?ed Careka of the complaint. The OC investigation revealed that Caremark had incorrectly linked four fax numbers for practitioners at Dunlap Pamin Physicians. Caremark uses a vendor to provide physician contact information. Caremark informed the vendor of the error and advised the vendor to update the contact information for the providers. In addition, Caremarlt updated its data ?les. With regards to the allegation that Caremark was unresponsive to complaints about this incident, Caremark was unable to ?nd evidence of any complaints received. As a result, Caremark retrained its employees to ensure they comply with the procedures for receiving and responding to complaints. OCR reviewed Caremark?s policies and procedures for uses and disclosures of and safeguarding PHI. These policies appear to comply with the Privacy Rule. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of Caremark. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Anne-Sophie Whitaker, Investigator, at 617-565-1356 (Voice), 617-565-1343 (TDD). Sincerely, Peter K. Chan Regional Manager