{7



DEPARTMENT OF HEALTH 3: HUMAN SERVICES

OFFICE OF THE SECRETARY

 

Voice? 
TDD - (215} 861-4440
FAX (215) 861-4431

Of?ce for Civil Rights, Region 
150 S. Independence Mall West
Public Ledger Building, Suite 37'2
Philadelphia, PA 19106-3499

1?5049
Amy Kaplan
215-86 1-4446

Reference:
Investigator:
Contact Telephone:

July 2, 2014

      

It I Ill


11921 Bourne?eld Way- Garrett Bldg.
Silver Spring, MD 20904



   

 

 

 

 

 


Dear

 

 

 

On January 22, 2014, the Department of Health and Human Services (HHS), O??ice for Civil
Rights (OCR) received a complaint alleging that Kaiser Pennanente (KP) is not in compliance
with the Federal standards for privacy of individually identi?able health information andfor the
Security Standards for the Protection of Electronic Protected Health Information (45 C. a
160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, 3? 
alleged that Kaiser enrolled him and his family under his estranged mother?s health plan
instead of his own policy without consent or authorization. This allegation could re?ect a
violation of 45 CPR. regarding impermissible disclosure of protected health
information, and or 45 CPR. regarding safeguards.

 

OCR enforces the Privacy Rule, and also enforces Federal civil rights laws which prohibit
discrimination in the delivery of health and human services because of race, color, national
origin, disability, age, and under certain circumstances, sex and religion.

On April 14, 2014, OCR noti?ed Kaiser Permanente of the complaint.

We have reviewed the matters raised in the corn laint. KP provided OCR with written assurance
of the following: They investigated complaint and have determined that his two
minor dependents were enrolled under the wrong subscriber as a result of human error by a KP
employee. employer?s agent contacted - - - - - bership Administration
. .
Department on January 3, 2014 requestmg enrollrnent (1 his dependents under
his employer group health plan (SunTrust) because {bliel-{bliilicl minor dependent needed to
seek healthcare services. KP informed OCR that at the time of this request, a KP Membership
Administration Group Account Representative identi?ed an existing KP member
who already had a KP medical record number (MRN) and who was covered as a dependent

    

     

   
   

  

  



 

under his mother's KP plan through her employer. I ister, who shares the same
name as wife, was also covered as a dependent under the Montgomery County
Public Schools (MCPS) plan. KP indicated that they believe that the KP employee, who was
asked to manuall enroll Member?s family, saw this information in the system and subsequently
enrolled dependent children under MCPS without obtaining proper veri?cations of
the enrollees andJor of the employer group plan. The enrollment of the minor dependent children
occurred on January 7, 2014, which automatically prompted th creation of RP ID cards for each
dependent, which were mailed to the subscriber of this account, ?63'me mother.


According to Kaiser?s records, advised a KP Customer Services Representative that
he was contacted by his mother about the receipt of the KP ID cards and subsequently retrieved
them from her. After the minor dependents were manually enrolled by the KP employee under
the incorrect plan, Member Administration Deartmn ceived an electronic enrollment
feed on January 9, 2014 from SunTrust requesting and his dependents be enrolled
under the SunTrust em lo er ou, health plan effective January 1, 2014. The system processed
this enrollment with as the subscriber and his wife and their two children as
dependents.

 

 

 

 

 

 

 

 

 

 

Kaiser assured OCR that the manager addressed this incident with the KP employee who made
the enrollment mistake and issued disciplinary actions consistent .icies and
procedures. In addition, it was determined that the employee who too complaint
call acted unprofessionally and this has been addressed with the employee. KP stated that the
only PHI disclosed were the actual two cards that were sent to the mother disclosing the two
dependent children?s names, dates of birth and medical record number. An accounting of
disclosures has been documented for this disclosure.

 

All matters raised by this complaint at the time it was ?led have now been resolved through the
voluntary compliance actions of Johns Hopkins. Therefore, OCR is closing this case.

determination as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR and does not apply to any other issues regarding compliance with the
Privacy Rule.

Under the Freedom of Information Act, it may be necessary for OCR to release this document
and related correspondence and records upon request. In the event OCR receives such a request,
we will seek to protect, to the extent provided by law, personal information which, if released,
would constitute an unwarranted invasion of privacy.

If you have any questions, please contact Amy Kaplan, at (215) 861?4446.

at (Ami/M

Barbara J. Holland
Regional Manager