DEPARTMENT OF HEALTH 8: HUMAN SERVICES Of?ce ?fths Secretary

 

voice . rem seams. {3001363.1ors

Office for Civil Rights, Region 
Government Center

J.F. Kennedy Federal Building,
Room 13?5

Boston. MA 2203-0002

TDD - [617) 565-1343. {300) 537-?697
Fax - 5-65-3809


JUL 2 3 ZUIZ

 

{hit?ithitfitci

 

 

 

{bit?ltbitfii?l

 

 

Privacy Of?cer


One CVS Drive

Woonsocket, R1 02895

 

Our Reference number: Ell-12442813

{bif?lttitii
Dear to)

 

 

{bit?iibitfl
{Ci

 

 

 

and

 

 

 

On April 27, 2012, the US. Department of Health and Human Services (HHS), Office for Civil
Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of
Individually Identi?able Health Information andfor the Security Standards for the Protection of
Electronic Protected Health Information (45 .F.R. Parts 160 and 164, Subparts A, C, and E, the
Privacy and Security Rules}. Speci?cally, the complaint alleges that the complainant?s protected
health information was impennissibly disclosed when her prescription was given to another
customer. This allegation could re?ect violations of 45 C.F.R. and
164.530(c) respectively.

OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which
prohibit discrimination in the deliver},r of health and human services beeause of race, color,
national origin, disability, age, and under certain circumstances, sex and religion.

We have reviewed the matters raised in the complaint. investigation revealed that an
employee of CVS gave the complainant?s prescription to another customer as a result of human
error. CVS has sanctioned the employee responsible for the error consistent with 
personnel policy and all employees at the location where the incident occurred have been
retrained on CVS policies concerning the Privacy Rule. CV8 has provided the correct medication
to the other patient and discarded and re?lled the complainant?s prescription. CVS accounted for
the disclosure in the complainant?s file. In addition, CVS has communicated the results of its
investigation with the complainant and sent her an apology letter.

CVS has provided OCR with privacy policies and procedures regarding impermissible uses and
disclosures of PHI, sanctions, and training and education, and said policies appear to be in
compliance with the Privacy Rule.

 

{li'li?libl ibliliilbllil
Page 2' t'Tlt'C] i and is: I

 

All matters raised by this complaint at the time it was ?led have now been resolved through the
voluntary compliance actions of CVS. Therefore, OCR is closing this case.

determination as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR.

Under the Freedom of Infonnation Act, we may be required to release this letter and other
information about this case upon request by the public. In the event OCR receives such a request,
we will make ever}r effort, as permitted by law, to protect infonnation that identi?es individuals
or that, if released, could constitute a clearly unwarranted invasion of personal privacy.

If you have any questions, please contact Keisha Edwards, Investigator, at
(617) 565-1349 (Voice), (617) 565-1343, (300) 53727697 (TDD).

Sincerely,

Mme

Peter K. Chan
Regional Manager