,srl?f?a. far 1 DEPARTMENT OF HEALTH 8.: HUMAN SERVICES OFFICE OF THE SECRETARY Voice- (404) 562-7836. (300) 383-1019 Of?ce for Civil Rights, Region TDD- [404) 552??334. {800} 531769? 61 Street. S. w. (FAX) {404] 5523331 Atlanta Federal Center, Suite 331?0 Atlanta, GA scans-3909 May 24, 201 1 {bli?liblimcl CVS Caremark Ann. CVS Drive Woonsocket, RI 02895 Privacy Of?cer SJ: 7" RE: ll ll l( (on CV3 (3mm Reference number: 1 1-124476 (we:er Dear and t: On March 2, 2011, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Information the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164 Sub arts A and E, the Privacy and Security Rules). Speci?cally, the complaint alleges that picked up her prescription at the CVS Caremark pharmacy on Ridgewood Avenue in Edgewater, Florida on February 22, 201 l. The complaint alleges that, saw picked up her arescription, an em loyee of CVS was standing ?across the room? and called out a description of (blialiblmicl medication. The complaint alleges that other atients in the waiting room could overhear the statement. The complaint further alleges that other. Hamming called the store manager to complain about the alleged privacy violation, but Istates that she never heard back ?om the store manager. These allegations could reflect violations of 45 CPR. 164.530(c) and respectively. OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. 011 March 21, 201 l, OCR noti?ed CVS of the allegations in the complaint. CVS acknowled ed that it received a phone call I and CVS said that two managers spoke with to apologize for the incident. CVS denied that its employee disclosed libli?llbliilicl I protected health information (PHI), but it retrained its staff on policies and procedures for safeguarding PHI. policy titled Oral Communications in the Pharmacy warns employees that in an ?open retail setting, others can potentially hear conversations at the pharmacy counter.? The policy instructs employees to ?Keep your voices low . . . policy titled General Use and Disclosure also instructs employees to speak quietly when consulting with patients from behind the pharmacy counter. This policy also states that employees should limit ?the information that id disclosed when Pharmacy employees make announcements in the Pharmacy regarding the availability of prescriptions . . . 3" OCR received documentation that the CVS employees at the Edgewood, Florida pharmacy were retrained in these policies. OCR asked CVS to also retrain the pharmacy?s managerial staff on policies and procedures for handling privacy complaints. The policy states that when patients raise privacy concerns, ?Employees should provide the customer with a copy of Notice of Privacy Practices, and point out . . . contact informationfor the Privacy Office and the process for submitting privacy-related complaints.? OCR received documentation that the pharmacy managers had been retrained on this policy. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of CVS. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. OCR only reviewed the evidence submitted pertinent to resolving the issue raised in the complaint. Under the Freedom of information Act, we may be required to release this letter and other inforrnation about this case upon request by the public. In the event OCR receives such a request, We will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact William Coniher, Investigator, at (404) 562?7523 (Voice), (404) 331-2867 (TDD). Sincerely, Roosevelt eeman Regional Manager OFFICE OF THE SECRETARY Office for Civil Rights, Region IV 61 Street, 5. W. Atlanta Federal Center, Suite 3370 Atlanta, GA 3?303-89?9 DEPARTMENT OF HEALTH 3i. HUMAN SERVICES Voice (4134) 562-7885. [800) 368-1019 TDD- {404) SEE-T834, [800) 53?-769? - (?104) 562?7881 May 24, 2011 CVS aremark Attn: Privacy Of?cer I CVS Drive Woonsocket, RI 02895 [on behalf O?tblt?libltihcl hr, CV3 Cal-mark Reference number: i 1-124476 near and On March 2, 201 l, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164 Sub arts A and E, the Privacy and Security Rules). Specifically, the complaint alleges that picked up her prescription at the CVS Caremark pharmacy on Rid gewood Avenue in Edgewater, Florida on February 22, 2011. The complaint alleges that, as picked up her arescription, an employee of CVS was standing ?across the room? and called out a description of Imedication. The complaint alleges that other atients in the waitin room could overhear the statement. The complaint further alleges that Wmother, - [led the store manager to complain about the alleged privacy violation, but tates that she never heard back from the store manager. These allegations could re?ect violations of 45 CPR. 164.530(c) and respectively. OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On March 21, 2011, OCR noti?ed CVS of the allegations in the complaint. CVS acknowled ed that it received a phone call from and CVS said that two managers spoke with Ig?imm I to apologize for the incident. CVS denied that its employee disclosed protected health information (PHI), but it retrained its staff on policies and procedures for safeguarding PHI. policy titled Oral Communications in the Pharmacy warns employees that in an ?open retail setting, others can potentially hear conversations at the pharmacy counter.? The policy instructs employees to ?Keep your voices low . . . policy titled General Use and Disclosure also instructs employees to speak quietly when consulting with patients from behind the pharmacy counter. This policy also states that employees should limit ?the information that id disclosed when Pharmacy employees make announcements in the Pharmacy regarding the availability of prescriptions . . . OCR received documentation that the CVS employees at the Edgewood, Florida pharmacy were retrained in these policies. OCR asked CVS to also retrain the pharmacy?s managerial staff on policies and procedures for handling privacy complaints. The policy states that when patients raise privacy concerns, ?Employees should provide the customer with a copy of Notice of Privacy Practices, and point out . . . contact information for the Privacy Of?ce and the process for submitting privacy-related complaints.? OCR received documentation that the pharmacy managers had been retrained on this policy. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of CVS. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. OCR only reviewed the evidence submitted pertinent to resolving the issue raised in the complaint. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact William Corriher, Investigator, at (404) 562-7523 (Voice), (404) 331-2867 (TDD). Sincerely, Roosevelt Free an Regional Manager