DEPARTMENT OF HEALTH 8: HUMAN SERVICES . OF I $333 (404)552-7836, {300) 353-1019 0 CE Din-[F SECRETARY - (404} 552-7884. {son} 537-7597 files for CIVII Rights, Region (FAX) (404} 552-7331 61 Street, 3w, . Atlanta Federal Center, Suite l6T70 Atlanta, GA 30303-3909 April 23, 2014 Ms. Andrea Wilson, RHIA, CIPP, CIPPIG VHA Privacy Implementation Coordinator Information Access and Privacy Of?ce Veterans Health Administration 810 Vermont Ave, N.W. Washington, DC. 20420 RE: v. Veterans Health Administration OCR Reference No: 12-133064 Dear P40109141 and Ms. Wilson: On January 20, 2012, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR), Region IV received your complaint in which you allege a violation of the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 CPR Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Noti?cation Rule Subpart - Noti?cation in Case of Breach of Unsecured Protected Health Information (PHI) (45 C.F.R. 164.400-1 64 .414). Speci?cally, rComplainant), states that the Carl Vinson Veteran Administration Medical Center (CVVAMC) retaliated against him for complaining that adequate safeguards were not followed with regard to his protected health information (PI-II), including privacy concerns regarding his PHI and Veteran Service Organization (V SO) pcrsonnel's access and handling of his PHI. Further, Complainant states the CVVAMC failed to provide him with a right to amend his medical record. Complainant states he ?rst discovered such potential impermissible usefdisclosures and additionally sought to have his medical record amended in May 2008', however, the CVVAMC has refused to correct such potential Privacy Rule violations. These allegations could re?ect violations of 45 CPR 164.526, and OCR enforces the Privacy Rule, and also enforces Federal civil rights laws that prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and, under certain circumstances, sex and religion. The Privacy Rule states that a covered entity may not use or disclose protected health information except as permitted or required by the Privacy Rule. See 45 C.F.R Additionally, 45 C.F.R {$164526 provides individuals with the right to have a covered entity amend PHI about the OCR Reference Number 12-133064 Page 2 of 3 individual in a designated records set for as long as the PHI is maintained in the designated record set. The Privacy Rule also mandates that a covered entity must have in place appropriate administrative, technical and physical safeguards to protect the privacy of protected health information. See 45 C.F.R. Finally, a covered entity must refrain from intimidating or retaliatory acts against an individual for the exercise of any right established or participation in any process provided for by the Privacy Rule. See C.F.R. On March 5, 2012, OCR noti?ed CVVAMC of the privacy complaint ?led by Complainant, and requested certain documents and information related to the facts alleged. On June 24, 2013, and again on November 13, 2013, CVVAMC provided a detailed response to the allegations along with its privacy policies, and copies of correspondence with Complainant. Complainant alleges that a progress note in his CV VAMC medical records inaccurately recounted statements that he made, and gave a false impression of him. He also disagreed with a statement attributed to him in an employment related investigation that the Vet Center in Macon, Georgia conducted relating to one of its employees. From our review of the relevant documents and allegations submitted by Complainant and the VAMC, it appears that Complainant received health services at the Readjustment Counseling Service (RC3) and Macon Vet Center over several years. During this time, the Macon Vet Center conducted an employment-related investigation of an employee and during the investigation solicited a statement from Complainant, which was recorded on VA Form 119, Report of Contact. This statement included misquotes, according to Complainant. OCR determined that the VA Form 119, Report of Contact, which Complainant requested to have amended, is a record from the Readj ustment Counseling Service (RCS). It appears that neither RCS nor the Macon Vet Center are af?liated with CV VAMC, and neither are covered entities under the Privacy Rule. Thus, the Privacy Rule right of amendment does not apply to the RC3 VA Form 119, and denial to amendment this form is not a violation of Complainant?s privacy rights. OCR notes that RCS did permit Complainant to clarify his statement and that RCS added his clarifying letter to the employee?s personnel ?le. See Letter from Acting Regional Manager of Southeast Region 3A, RCS, to Complainant (February 23, 201 1), provided by Complainant. Additionally, Complainant was concerned that notation of the statements attributed to him resulted in retaliation against him by the Macon Vet Center. Again, the Macon Vet Center is not a covered entity under the Privacy Rule; thus, the retaliation provisions are not applicable. Regarding Complainant?s allegations that a progress note maintained in his designated record set at CV VAMC contains erroneous statements attributed to him and that CV VAMC has refused to amend this record, CV VAMC provided evidence that on November 17, 2011, CV Director provided Complainant with instructions on requesting an amendment. CV VAMC contends that they have not received a written request from Complainant for an amendment pursuant to the guidance provided. Complainant con?rmed that he made an oral request to amend his records to the Privacy Of?cer during a phone call, but as of the date of this letter, OCR has not received any evidence that Complainant has made a written request. The Privacy Rule at 45 C.F.R permits a covered entity to require that the request be provided in writing. Thus, OCR cannot substantiate that a violation occurred. OCR Reference Number 12438064 Page 3 of 3 detennination as stated in this letter applies oniy to the allegations in this complaint that were reviewed by OCR. OCR only reviewed the evidence of record pertinent to resolving the issues referenced in the aforementioned complaint. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identifies individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please contact Sonya Hana? at (404) 562-7865 (Voice), (404) 562-7884 (TDD). Sincerely, Timothy Noonanv Regional Manager Of?ce for Civil Rights