arm's 3 :1ch .5 Voice 555-1340, {800} 363-1019, TDD 565- 13431300) 531-759? FAX 565-3809. Of?ce for C'?'il Region I JFK Federal Building, Room 1875 JUN 25 an {bltEliUllTliCJ Adviser Information Governance and Privacy CVS Caremark One CVS Drive Woonsocket, RI 02895 Our Reference number: 13-151216 .s .7 eastern Dear {bit it a, {Cl I: On November 9, 2012, the U.S. Department of Health and Human Services (HHS), O?ice for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of Individually Identifiable Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, the complaint alleges that an employee of CVS Caremark impermissiny disclosed his protected health information when he gave doctu?nents related to complainant?s ?u shot to another customer. This allegation could re?ect a violation of 45 CPR. ?164.502(a) and OCR enforces the Privacy and Security Rules. and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On April 24, 2013, OCR noti?ed CVS Caremark of the complaint. CVS Caremark provided us with written assurance of the following: an employee of CVS accidentally handed the paperwork of complainant to the customer in front of him; this was against CVS policy. The employee in question has been sanctioned for this incident and the staff at the pharmacy has been retrained. In addition, CVS Caremark provided its policies for safeguarding patient protected health information; these policies appear to comply with the Privacy Rule. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of CVS Caremark. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Phil Lewis, Investigator, at (617) 565-1355 (Voice), (617) 565-1343 (TDD). Sincerely, I we (?u/wuss Peter K. Chan Regional Manager