FF slum-lsDEPARTMENT OF HEALTH HUMAN SERVICES OFFICE OF THE SECRETARY
Voice (617] 565-1340, (300) 363-1019, TDD 565- 1343, (300} Bil-1'69?
FAX (617) 565-3809, Of?ce for Civil Rights, Region I
"hm JFK Federal Building, Room 1875
Government Center
 9  Boston, MA 02203-0002

 



 

 

 

 

Chief

DHA Privacy an Civil Liberties Of?ce
Of?ce of the Assistant Secretary of Defense
Health Affairs

7700 Arlington Boulevard, Suit
Falls Church, VA 22042-5101

 

 

 

Our Reference number: 01-13-1 S9469

 

 

and (blt?ltbl?ltci 

 

 

 

 

 

 

On April 29, 2013, the US. Department of Health and Human Services (HHS), Of?ce for Civil
Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of
Individually Identi?able Health Information andz?or the Security Standards for the Protection of
Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the
Privacy and Security Rules). Speci?cally, the complainant alleged that her protected health
information was impermissiny disclosed by Dwight David Eisenhower Army Medical Center
(TRICARE) to her employer. This allegation could re?ect a violation of 45 C.F.R. 
164.502(a) and 

OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which
prohibit discrimination in the delivery of health and human services because of race, color,
national origin, disability, age, and under certain circumstances, sex and religion.

On November 7, 2013, OCR notified TRICARE of the complaint.

The OCR investigation revealed that after the complainant voiced concerns to her supervisor that
a move to a new building would complicate her allergies, her supervisor contacted the
complainant?s physician to discuss the issue. The physician then disclosed information
regarding the complainant?s allergy history to the SuperviSOr. As a result of the disclosure, the
physician was counseled and required to complete remedial HIPAA training, in accordance with
sanctions policy. OCR reviewed policies and procedures for uses and
disclosures of PHI. These policies and procedures appear to comply with the Privacy Rule.

All matters raised by this complaint at the time it was ?led have now been resolved through the
voluntary compliance actions of TRICARE. Therefore, OCR is closing this case.

determination as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR.

Under the Freedom of Information Act, we may be required to release this letter and other
information about this case upon request by the public. In the event OCR receives such a request,
we will make every effort, as permitted by law, to protect information that identi?es individuals
or that, if released, could constitute a clearly unwarranted invasion of personal privacy.

If you have any questions, please contact Anne-Sephie Whitaker, Investigator, at
617-565-1356 (Voice), 617?565-1343 (TDD).

Sincerely,
?lo. veg-XL 

Susan M. Pezzullo Rhodes
Regional Manager