arm?s DEPARTMENT OF HEALTH 8: HUMAN SERVICES OFFICE OF THE SECRETARY Voice- (215) 861-4441 Of?ce for Civil Rights, Region TDD -v {215} 861-4440 150 5. Independence Hall West FAX (215} 361-4431 Public Ledger Building, Suite 372 Philadelphia, PA 19106-3499 Reference: 1 58355 Investigator: Diana E. Vincenzo Contact Telephone: 215-861-421? August 28, 2013 Dem (grantee: On April 10, 2013, the US. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), received your complaint alleging that Washington DC VA Medical Center, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and {64, Subparts A, C, and E, the Privacy and Security Rules). Specifically, you allege that, on March 26, 2013, the Washington DC VA Medical Center would not accept fax medical record requests. This allegation could re?ect a violation ot?45 C.F.R. 164.524. Thank you for bringing this matter to attention Yoru- complaint is an integral part of enforcement efforts. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. The Privacy Rule states that an individual has the right to access hisiher promoted health information (Pl-ll), maintained by a covered entity in a designated record set, for as long as the PHI is maintained in the designated record set medical or billing records). 45 C.F.R. 164.524 If an individual requests an electronic copy of that PHI, except under certain circumstances, a covered entity is required to provide the individual with such electronic copy to the extent it is readin producible. A covered entity must act on the individual?s request for access no later than 30 days after receipt of such a request and in certain circumstances no later than 60 days after the receipt of such a request. We have carefully reviewed your complaint against Washington DC VA Medical Center and have determined to resolve this matter informally tint-ugh the provision of technical assistance to Washington DC VA Medical Center. Should OCR receive a similar allegation of noncompliance against Washington DC VA Medical Center in the fume, OCR may initiate a formal investigation of that matter. For your informational pmposes, OCR has enclosed material regarding the Privacy Rule provisions related to Access to Medical Records. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. - Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please contact Diana E. Vincenzo, Investigator, at (215) 861-4217 (Voice) or (215) 861-4440 (TDD). Sincerely, Barbara J. Hollan Regional Manager Enclosin'e: Individual?s Right to Access Medical Records ?nm.%a i DEPARTMENT OF HEALTH HUMAN SERVICES OFFICE OF THE SECRETARY Office for Civil Rights, Region 111 15a 5. Independence Hall was Public Ledger Building, Suite 3?2 Philadelphia, PA 19106?3499 Voice? {215} 361-4441 TDD - {215) 361.4440 FAX - (215) 361-4431 153355 Diane E. Vincenzo 215-861-421? Reference Investigator: Contact Telephone: August 28, 2013 Washington DC VA Medical Center 50 Irving St. NW Washington DC. 20010 Release of Information Department Am; {blf?litliilicl near On April 10, 2013, the US. Department of Health and Human Services (HHS), O?ce for Civil Rights (OCR), received a complaint alleging that Washington DC VA Medical Center, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 CPR. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, the complainant, {blislitliili'iil alleges that, on March 26, 3013, 118 ?'03 told that the Medical Center would no longer horror hisfoxed medical record requests. This allegation could re?ect a violation of 45 C.F.R. 164.524. OCR enforces the Privacy, Secm'iiy, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sea and religion. The Privacy Rule states that an individual has the right to access hislher protected health information (PHI), maintained by a covered entity in a designated record set, for as long as the is maintained in the designated record set medical or billing records). 45 C.F.R. 164.524 If an individual requests an electronic copy of that PHI, except under certain circumstances, a covered entity is required to provide the individual with such electronic copy to the extent it is readily producible. A covered entity must act on the individual?s request for access no later than 30 days alter receipt of such a request and in certain circumstances no later than 60 days a?cr the receipt of such a request. Pursuant to its authority under 45 CPR. 160.304(a) and OCR has determined to resolve this matter informally through the provision of technical assistance to Washington DC VA Medical Center. To that end, OCR has enclosed material explaining the Privacy Rule provisions related to Access to Medical Records. You are encouraged to review these materials closely and to share them with your staff as part of the Health Insurance Portability and Aocotmtability Act (HIPAA) training you provide to your workforce. You are also encouraged to assess and determine whether there may have been any noncompliance as alleged by the complainant in this matter, and, if so, to take the steps necessary to ensure such noncompliance does not occur in the future. In addition, OCR encourages you to review the facts of this individual request for access and provide the requested access swi?ly if the request meets the requirements of the Privacy Rule. Should OCR receive a similar allegation of noncompliance against Washington DC VA Medical Center in the future, OCR may initiate a formal investigation of that matter. In addition, please note that, after a period of six months has passed, OCR may initiate and conduct a compliance review of Washington DC VA Medical Center related to Washington DC VA Medical Center?s compliance with the Access provisions of the Privacy Rule. Based on the foregoing, OCR is closing this case without ?rrther action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal pnvacy. .. . If you have any questions regarding this matter, please contact Diana E. Vincenzo, Investigator, at (215) 861-4217 (Voice) or (215) 861-4440 (TDD). [AW/ms Barbara J. Holland Regional Manager Enclosure: Individual?s Right to Access Medical Records