Ems

nsranv
Voice (617) 565-1340, (800) 368-1019. TDD (617) 565- I343. [300} 53-7697

FAX 565-3809, DEC: for Civil Rights, Region 1
JFK Federal Building, Room 1815

Government Center

APR 3 0 anti Bosseth anus-um

 

{bli?libliilicl

 

 

 

{bli?ltbliilicl

 

 

 

Adviser, Government and Privacy
CVS

One CVS Drive

Woonsocket, Rl 02895

Our Reference number: 01-13-152889

 

 

{bli?li?liilfcl {bli?libliilicl

 

 

Deer and

 

 

 

 

On December 14, 2012, the US. Department of Health and Human Services (HHS), Of?ce for
Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for
Privacy of Individually Identi?able Health information andfor the Security Standards for the
Protection of Electronic Protected Health Information (45 CPR. Parts 160 and 164, Subparls A,
C, and E, the Privacy and Security Rules). Speci?cally, the complaint alleged that CVS
employees failed to verify a patient? information prior to releasing the patient?s prescription to
his father. This allegation could re?ect a violation of45 C.F.R. and
164.53 0( 

OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which
prohibit discrimination in the delivery of health and human services because of race, color,
national origin, disability, age, and under certain circumstances, sex and religion.

011 Januaryr 2, 2013, OCR noti?ed CVS of the complaint.

The OCR investigation revealed that an employee of CVS failed to verify the date of birth prior
to dispensing a prescription to a patient with the same name. The employee was sanctioned in
accordance with sanctions policy and retrained on the veri?cation procedures. In addition,
as a result of this investigation, CV3 has instituted a new program to ensure the right patient
receives the correct prescription. OCR reviewed policies and procedures for uses and
disclosures of PHI, safeguarding PHI and veri?cation. These policies and procedures appear to
comply with the Privacy Rule.

All matters raised by this complaint at the time it was ?led have now been resolved through the
voluntary compliance actions of CVS. Therefore, OCR is closing this case.

determination as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR.

Under the Freedom of Information Act, we may be required to release this letter and other
information about this case upon request by the public. In the event OCR receives such a request,
we will make every effort, as permitted bylaw, to protect information that identi?es individuals
or that, if released, could constitute a clearly unwarranted invasion of personal privacy.

If you have any questions, please contact Anne-Sophie Whitaker, Investigator, at
617-565-1356 (Voice), 617-565-1343 (TDD).

Sincerely,



Peter K. Chan
Regional Manager