DEPARTMENT OF HEALTH E: HUMAN SERVICES OFFICE OF THE SECRETARY Volca- (215)361-4441 Of?ce for Civil Rights, aeglon TDD - {215) 851-4440 150 5. Independence Hall West PM - (215) 861-4431 Public Ledger Building, Suite 3?2 Weenies: Philadelphia, PA 19106-3499 Reference: 14-31290 Investigator: Ralph Balsamo Contact Telephone: 215-861-4444 March 3, 2014 {blii?libllill?l Dem On November 25, 2013, the U.S. of Health and Human Services (HHS), Of?ce for Civil Rights (OCR). Region received your complaint alleging that Capital Woman?s Care, the covered entity hasviolated the Federal Standards for Privacy of Individually Identifiable Health Information (45 C.F.R, Parts 160 and 164, Subparts A and E, the Privacy Rule). Speci?cally, you allege that the Department of Veterans Affairs mailed your spouse another individual's protected health infonnation. This allegation could re?ect a idolation of 45 C.F.R. 164.5il2(a) and Thank you for bringing this matter to attention. Your complaint plays an integral part in OCR's enforcemmit efforts. OCRenforces the Privacy, Security, and Breach Noti?cation Rides, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. We have carefully reviewed your complaint against the covered entity and have determined to resolve this matter informally through the provision of technical assistance to the Deparmrent of Veterans A?airs. We have noti?ed the Department of Veterans Affairs about the issue regarding the protected health information you received. Should OCR receive a similar allegation of noncompliance against the Department of Veterans Affairs in the future, OCR may initiate a formal investigation of that matter. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewedbyOCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. in the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constimte a clearly unwarranted invasion of personal privacy. lfyou have any questions, please do not hesitate to contact Mr. Ralph Balsarno of my staff at (215) 861- 4444 or (215) 861-4440 Sin 1y, e- M?a? Barbara J. Holland Regional Manager DEPARTMENT OF HEALTH HUMAN SERVICES OFFICE OF THE SECRETARY Voice- (215) 861-4441 Office for Civil Rights. Region It! Too - (215) 361-4440 15o 5. Independence Hall West FAX {215) 861-4431 Public Ledger Buliding, Suite 372 mm Philadelphia, PA 191?6-3499 Reference: 14-1?1290 Investigator: Ralph Balsamo Contact Telephone: 215-861-4444 March3, 2014 Ms. Andra 1Wilson, RI-ILA, CIPP, VHA Privacy Implementation Coordinator Information Access and Prhracy Of?ce? Department of Veterans Aliens-Veterans Health Administration 810 Vermont Ave, NW Washington DC 20420 Dear Ms. Wilson: 011 November 25, 2013, the US. Department of Health and Human Services (HI-IS), Of?ce for Civil Rights (OCR), Region received a complaint alleging that the Veterans Health Administration, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information 45 C.F.R. Parts 160 and 164, Subparm A and E, the Privacy Rule). Speci?cally, the complainant. alleges that the of Veterans Affairs mailed her spouse another individual's protected health information. This allegation could re?ect a violation of 45 CPR. 164.502(a) and OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race. color, national orig'm, disability, age, and under certain sex and religion. Generally, the Privacy Rule permits a covered entityao make disclosures of protected health information (PHI) for a permitted purpose, through a variety of means, such as by mail or facsimile machine, as long as the covered entity, when doing so, uses reasonable and appropriate administrative. technical, and physical safeguards to protect the privacy of the PI-IL See 45 CPR. These safeguards may vary depending on the mode of communication med. For example, when faxing PHI to a telephone number that is not used regularly, a reasonable safeguard may involve a covered entity ?rst con?rming the fax number with the intended recipient of the far. In this matter, the complainant alleges that PHI was impermissiny disclosed either through the mail or by fax. Pursuant to its authority under 45 C.F.R. 1603mm and OCR has determined to resolve this matter informally through the provision of technical assistance to the covered entity. To that end, OCR has enclosed a checklist of reminders on how to safely tree the mail or fax machines when sending PHI. You are encouraged to review these materials closely and to share them with your sta??as part ofthe Health Insurance Portability and Accountability Act training you provide to your workforce. You are also encouraged to assess and determine whether there may have been an incident of noncompliance as alleged by the complainant in this matter, and, if so, to take the steps necessao' to ensure such noncompliance does not occur in the future. Please contact OCR if you need further information regarding the allegations in this matter. Should OCR receive a similar allegation of noncompliance against the Veterans Health Administration in the future, OCR may initiate a formal investigation of that matter. . Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. in the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constimte a clearly unwarranted invasion of personal privacy. If you have any questions, please do not hesitate to contact Mr. Ralph Balsamo of my staff at (215) 36]- 4444 or (215) 861?4440 (TTY). Sincerely, ?deM/W Barbara J. Holland Regional Manager Enclosure: Checklist