?h 1? . a: 3 1Voice (617) 565-1340, (800) 363-1019, (617) 565- I343, (300) FAX (617) 565-3309, Of?ce for Civil Rights, Region I JFK Federal Building, Room 1915 Government Center Boston, MA 02203-1302 SEP 1 7 2013 OCR Transaction Number: 13?159646 Dear On May 8, 2013, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR), Region I received your complaint alleging that Atlanta Veteran?s Medical Center, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information (45 C.F.R. Parts 160 and 164, Subparts A and E, the Privacy Rule). Speci?cally, you allege that Atlanta Veteran?s Medical Center has refused to release all of your records including those used as a basis of denying a records redaction request. This allegation could re?ect a violation of 45 C.F.R. 164.524. Thank you for bringing this matter to attention. Your complaint is an integral part of enforcement efforts. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. The Privacy Rule states that an individual has the right to access hisr'her protected health information (PHI), maintained by a covered entity in a designated record set, for as long as the is maintained in the designated record set medical or billing records). 45 CPR. 164.524 If an individual requests an electronic copy of that PHI, except under certain circumstances, a covered entity is required to provide the individual with such electronic copy to the extent it is readily producible. A covered entity must act on the individual?s request for access no later than 30 days a?er receipt of such a request and in certain circumstances no later than 60 days after the receipt of such a request. - We have carefully reviewed your complaint against Atlanta Veteran?s Medical Center and have determined to resolve this matter informally through the provision of technical assistance to Atlanta Veteran?s Medical Center. Should OCR receive a similar allegation of noncompliance against Atlanta Veteran?s Medical Center in the future, OCR may initiate a formal investigation of that matter. For your informational purposes, OCR has enclosed material regarding the Privacy Rule provisions related to Access to Medical Records. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other hrformation about this case upon request by the public, In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please contact Phil Lewis, Investigator, at (617) 565-1355 (Voice) or (617) 565-1343 (TDD). Sincerely, gin-me V- Peter Chan Regional Manager Enclosure: Individual?s Right to Access Medical Records i I DEPARTM a Voice 555-1340. 555- 1343, (see) 537?1597 an? Fame?) ass-sans, 11mm in; g? - MAN ERVI Of?ce for Civil Rights, Region I JFK Fedml Building, Room 1815 Walnut Center Boston, MA 02203-0002 SEP 1 7 2013 Director, Privacy and Civil Liberties Of?ce TRICARE Manaement Activity Skyline 5, Suite 5111Leesburg 1 Falls Church VA 22041 OCR Transaction Number: 13-159646 .b Dear (bl'lBll it l{ On May 8, 2013, the U.S. Department of Health and Human Services (HI-IS), Of?ce for Civil Rights (OCR), Region I received a complaint alleging that Atlanta Veteran?s Medical Center, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information (45 C.F.R. Parts 160 and 164, Subparts A and E, the Privacy Rule). Speci?cally, the complainant alleges that Atlanta Veteran?s Medical Center has refused to release all of complainant?s records including those used as a basis of denying a records redaction request. This allegation could re?ect a violation of 45 C.F.R. 164.524. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. The Privacy Rule states that an individual has the right to access hisfher protected health information (PHI), maintained by a covered entity in a designated record set, for as long as the PHI is maintained in the designated record set medical or billing records). 45 CPR. 164.524 If an individual requests an electronic copy of that PHI, except under certain circumstances, a covered entity is required to provide the individual with such electronic copy to the extent it is readily producible. A covered entity must act on the individual?s request for access no later than 30 days a?er receipt of such a request and in certain circumstances no later than 60 days after the receipt of such a request. Pursuant to its authority under 45 CPR. 160.304{a) and OCR has determined to resolve this matter informally through the provision of technical assistance to Atlanta Veteran?s Medical Center . To that end, OCR has enclosed material explaining the Privacy Rule provisions related to Access to Medical Records. You are encouraged to review these materials closely and to share them with your staff as part of the Health Insurance Portability and Accountability Act (HIPAA) training you provide to your workforce. You are also encouraged to assess and determine whether there may have been any noncompliance as alleged by the complainant in this matter, and, if so, to take the steps necessary to ensure such noncompliance does not occur in the future. In addition, OCR encourages you to review the facts of this individual request for access and provide the requested access swiftly if the request meets the requirements of the Privacy Rule. Should OCR receive a similar allegation of noncompliance against Atlanta Veteran?s Medical Center in the future, OCR may initiate a formal investigation of that matter. In addition, please note that, after a period of six months has passed, OCR may initiate and conduct a compliance review of Atlanta Veteran?s Medical Center related to Atlanta Veteran?s Medical Center?s compliance with the Access provisions of the Privacy Rule. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please contact Phil Lewis, Investigator, at (617) 565-1355 (Voice) or (617) 565-1343 (TDD). Sincerely, Peter Chan Regional Manager Enclosure: Individual?s Right to Access Medical Records