.39 1 DEPARTMENT OF HEALTH 3: HUMAN SERVICES OFFICE OF THE SECRETARY =55 Voice 565-1340, (800) 368-1019, TDD 565- 1343, (300) 531769? r' FAX 565-3809, Of?ce for Civil Rights, Region I JFK Federal Building, Room 1er Government Center Boston. MA 02203-0002 JUL 1 a 21m I Privacy Investigator CVS Caremark9501 E. Shea Boulevard Scottsdale, AZ 85260-6719 Our Reference Number 14-178112 (bl(5l.(bl(7l(Cl (bll?llbl?ltC) Dear and On February 10, 2014, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Information andf or the Security Standards for the Protection of Electronic Protected Health Information (45 CPR. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, the complainant alleges during a period from the summer of 201 3 through the time of her complaint submission, CVS Caremark (CVS) had continually faxed documents containing the protected health information (PHI) of patients of a physician in Hawaii to a facility in Texas with an employee of the same name. The complainant stated that she had written and called CVS on numerous occasions to correct this matter, but her complaints to CVS had been ignored. This allegation could reflect violations of 45 CPR. and 164.5306). OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On April 28, January 13, 2014, OCR noti?ed CVS ofthe complaint. The complainant had provided OCR with copies of her attempts to resolve this situation with CVS. investigation determined that the missent fax documents were sent in conjunction with a drug utilization program (DUR) which retrospectively looks at certain drug utilization and faxes information on patient drug utilization to the prescriber, based on the prescriber selected by the dispensing pharmacy at the point of sale. In this case, there were two prescribers with the same name, one in Texas and one in Hawaii. The dispensing pharmacy in Hawaii selected the wrong prescriber (the one in Texas) in processing the prescription claim. As a result, DUR faxes were sent to the doctor in Texas rather than to the actual prescribing doctor in Hawaii. Page 2- 14-178112 When noti?ed by OCR of the complaint, CVS took immediate steps to resolve the situation. They contacted the dispensing pharmacy to advise them of their error and ensure that they had the correct contact information for each of the doctors in their data base. CVS uses a third party vendor, Health Market Science (HMS) to provide CVS with a master provider data base, which is updated CVS reviewed the HMS contact information for both doctors, and found that HMS had incorrectly linked the fax contact information for the doctor in Texas to that of the doctor in Hawaii. CVS corrected this provider data base, and noti?ed HMS of the error, requesting they update their record of providers immediately. CVS was unable to explain why the complaints were not handled properly when the complainant originally contacted CVS. The Privacy Of?ce was not able to document that the complaints had been made, although they did not dispute this. To address the problem, contact was made by the Privacy Of?ce with all CVS mailrooms to readdress the proper routing of all written complaints and communications to the Privacy Of?ce, and an interdental reminder on how to handle written communications to the Privacy Of?ce was issued. Regarding telephone calls, all calls concerning privacy issues which are answered by the Customer Care representatives are supposed to be reported to the Privacy Of?ce. All Customer Care supervisors have reviewed with their telephone representatives the proper protocols regarding submitting reports to the Privacy Of?ce. An apology letter was sent to with an explanation as to each of her concerns, along with an explanation of the corrective steps CVS had taken. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of CVS Caremark. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Vicki Kaufman, Investigator, at 617-565-1344 (Voice), 617-565-1343 (TDD). Sincerely, sax .1 Susan M. Pezzullo Rhodes Regional Manager