flew i DEPARTMENT OF HEALTH 8t HUMAN SERVICES OFFICE on THE SECRETARY Voice? TDD - {215) 861-4440 FAX - {215) 861-4431 hm}: .ggv?ggr Of?ce for Civil Rights, Region 150 3. Independence Hall West Public Ledger Building, Suite 372 Philadelphia, PA 19106?3499 Reference: 13-164216 Investigator: Alisha Welch Contact Telephone: 215-861-4439 October 25, 2013 (Dirt?) I Adviser, Government and Privacy CVS Pharmacy One CVS Dr. Woonsocket, RI 02895 Deal. On August 5, 2013, the Deparnnent of Health and Human Services (HI-IS), O?ce for Civil Rights (OCR) received a complaint alleging that CVS Pharmacy is not in compliance with the Federal Standards for Privacy of Individually Identi?able Health Information anon the Security Standards for the Protection of Electronic Protected Health Information (45 CPR. Parts 160 and 164, Subparts c, and E, the Privacy and Security Rules). Speci?cally, (?the Complainant?) alleges an employee of CVS Pharmacy in Dallas, (?Covered Entity?) disclosed his protected health information to Wake Forest Baptist Medical Center, where the Complainant has never sought treatment. This allegation could represent a violation of 45 C.F.R. 164.502(a) [impermissible uses and disclosures] of the Privacy Rule. OCR enl'orees the Privacy Rule, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On August 26, 2013, OCR noti?ed the Covered Entity of the complaint. In a correspondence received by OCR on October 17, 2013, the Covered Entity provided OCR with a written explanation of the circumstances surrounding this complaint. The Coveted Entity received a new prescription for the Complainant. There are two providers with the name of When an employee at the Covered Entity was completing the Complainant?s pa pro e, i employee inadvertently chose at r' ?1 1 Medical Center as the provider, rather than the Complainant?s physician, in The Covered Entity contacted Wake Forest Baptist Medical Censor to verify the Complainant?s prescription. The Covered Entity provided OCR with written assurances that the Complainant?s patient pro?le was updated to include the correct provider. The Covered Entity contacted Wake Forest Baptist Medical Center and requested that it destroy any of the Complainant?s protected health information it may have inadvertently received. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of the Covered Entity. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted bylaw, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Alisha Welch, at (215) 861-4439. Sincerely, JWQJ WK Barbara I. Holland Regional Manager