sill'I'iC'r 5 e? ??37 ?v ?F'ser OFFICE OF TH SECRETARY Ot?ce for Civil Rights, Region IV 6i Street, SW. Atlanta Federal Center, Suite Atlanta. GA 30303r8909 DEPARTMENT OF HEALTH 8: HUMAN SERVICES Voice - (404) sea-race, (sec) sea-1mg Ton - (404) sea-r334, taco] ssr-rssr (FAX) October 24, 2012 VHA Information Access and Privacy Of?ce Attn: Andrea Wilson, VHA Privacy Specialist Department of Veterans Affairs 810 Vermont Ave, N. W. (1 OPEC) Washington, DC. 20420 Re: (?Haliblmg vs. Central Alabama Veterans Health Care stem OCR Reference Number: 12-140365 Dear Egljl?liblm and Ms. Wilson: On January 24, 2012, the U.S. Department of Health and an Services (HHS), Of?ce for Rights (OCR) 11303in 51 001111313th from W?bmplainant, alleging that Central and 164, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Noti?cation Rule Subpart - Noti?cation in Case of Breach of Unsecured Protected Health Information (4S C.F.R. Speci?cally, Complainant alleges that Central Alabama VA Health Care has not complied with Complainant?s amendment requests records. Allegedly, beginning in 2010 and continuing to the present, amendment through the CAVHCS for ords to comply with the requirements set forth in the settlement agreement {blmlibmm Complainant requested an amendment to her medical records to re?ect a correction in her mental health diagnoses to Gender or at least a notation of Complainant?s opinion of the incorrect diagnoses in her medical records. Complainant alleges that, to date, such an amendment has not been accomplished, despite CAVHCS assertions to the contrary. These allegations could re?ect violations of 45 C.F.R. System (hereina?er, for her medical Complainant requested an Please note that 45 C.F.R. 164.526(a) provides that an individual has a right to have a covered entity amend PHI or a record about the individual. The provision also states that any denial of such request for amendment must be provided in writing and such denial must be based on at least one of the grounds set forth in 45 C.F.R. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. OCR noti?ed CAVHCS of the complaint filed by Complainant on June 12, 2012. This notification was initial written communication with the covered entity about the complaint, and it describes the act(s) andfor omission(s) that are the basis of the complaint. In response to noti?cation Andrea Wilson, Privacy Implementation Coordinator, submitted a response of behalf of CAVHCS on July 16, 2012. investigation included a review of the covered entity?s pertinent policies and procedures, as well as, the covered entity?s investigation into the allegations and HIPAA training documentation. Accordingly, OCR reviewed the following HIPAA privacy policies and procedures: Privacy Policy,? ?Uses and Disclosures,? and ?Administrative Requirements,? which included the ?Compliance with Privacy Policies,? ?Documentation,? ?Complaint Process,? ?Reasonable Safeguards,? ?Sanctions,? and ?Privacy Training and Education.? OCR also reviewed ?Individual?s Rights,? which included ?Verification of Identity,? ?Right of Access,? ?Notice of Privacy Practices,? Requests,? ?Con?dential Communication Request,? ?Restriction Request,? ?Facility Directory Opt-Out,? and ?Accounting of Disclosures.? OCR examined all of CAVHCS submitted policies and procedures and found no indication of noncompliance with the HIPAA Privacy Rules. OCR also reviewed CAVHCS response, as well as proof of HIPAA training documentation. In its response, CAVHCS reports that on July 8, 2010, July 9, 2010, December 21, 2010, and February 9, 2011, Complainant made amendment requests asking that her medical records re?ect that she is a hypo gonadal female and that notes authored by CRNP removed from her record. CAVHCS admits that the facility Privacy Of?cer did not respond to Complainant in a timely manner regarding her amendment requests. The covered entity reports that at the time of receipt of Complainant?s requests, the new Chief of Health Information Management Services was in initial training and unaware of her responsibilities to make amendments. However, it states that despite the failure of the new Chief of HIMS to resolve the complaint, Chief of Staff was working with Complainant?s health care providenw to resolve the request. In particular, CAVHCS provided evidence re?ecting that on September 15, 2012, made a notation on Complainant?s medical record that ?Veteran shall be described as female in all written and verbal communication. She is medically and legally a hypogcnadal female.? Despite the notation, the covered entity does not indicate that the amendment to medical records was made at that time. However, CAVHCS provided evidence that it has granted Complainant?s requests for amendment since that time, and as of July 12, 2012, it sent Complainant a letter indicating as much. Based on a review of the evidence, OCR determined that CAVHCS violated the Privacy Rule as it did not respond in a timely manner to Complainant?s requests for amendment to her medical record set. However, CAVHCS has provided written assurances and evidence of the following corrective measures: 1) on July 12, 2012, it provided Complainant with notice that her amendment request was granted; 2) although the notes from CRNP Emmi? I 3 could not be deleted, notations were made to indicate the erroneous entry, however; 3) on September 15, 2012, Complainant?s health care provider made a notation in her medical record for ?iture notations to re?ect the amendments; 4) CAVHSC has improved its amendment process to be more time efficient; 5) CAVHCS is delineating responsibility for amendment requests between Chief of Health Information Management Services and Privacy Officer; 6) transgender issues, which were associated with a record management incident in this case, are being de?ned through a national VA policy. Upon review of all pertinent policies and procedures that are deemed compliant with the requirements of the Privacy Rule, and the voluntarily compliance with the Privacy Rule, OCR determines that all matters raised by the complaint, at the time it was ?led, have now been resolved through the voluntary compliance actions of CAVHCS. Therefore, OCR is closing this case. OCR's determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identifies individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Sonya Hana?, Investigator, at sonya.hanafi@hhs. gov (404) 562-?876 (Voice), or (404) 562-7884 (TDD). Sincerely, Roosevelt Freeman Regional Manager OCR Region IV