?alumna DEPARTMENT OF HEALTH HUMAN SERVICES Of?ce ?the Secretary 4? 5? Voice - (404) 562-7886. (800) 363-1019 Of?ce for Civil Rights. Region IV TDD - (404) 562-7884. (860) 537*?697 Atlanta Federal Center Fax - (404) 562-?381 51 St. SW, . Suite 16T7CI Atlanta GA 30303 January 24, 2012 {bit?llbitiitci CVS Caremark Attn Privacy Of?cer 1 CVS Drive Woonsocket, RI 02895 v. Caremark Reference numbers: 1 1-12855 {bll?libllillcl (bl?illbl and Dear On June 2, 2011, the US. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health information andfor the Security Standards for the Protection of Electronic Protected Health information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, the complaint alleges that the CVS Caremark pharmacy at 12012 Abercorn Street in Savannah, Georgia confused the medic 4 .a . with other patients with the same name. The complaint alleges complained to CVS several times about the issue. These allegations could re?ect violations of 45 CPR. and 16453001). OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On November 28, 201 l, OCR noti?ed CVS of the allegations in the complaint. In response, CVS acknowledged that prescription was mistakenly ?lled under another the records of another patient with a similar name. When Iinformed CVS of the error in April 201 1, VS said it a logized to libii?ilibimici corrected the information in records, and contacted Wusurance to have the claim reversed. The responsible employee was retrained in privacy policies and procedures and issued a ?final warning? regarding her compliance with policies and procedures. CVS told OCR that the employee left CVS soon a?erwards. Upon being noti?ed of investigation, CVS retrained the entire pharmacy staff at the Savannah pharmacy, even though the responsible employee no longer works there. OCR received documentation of the staff?s retraining. CVS sent OCR copies of its privacy policies and procedures, as well as its procedures for ?lling and dispensing prescription medications. All matters raised by this complaint at the time it was ?led have now been resolved through the volunt compliance actions of CVS Caremark. Although a CVS employee mistakenly ?lled libii?iibmm prescription under another customer?s name, CVS corrected the information in its system, apologized to sanctioned the responsible employee, and retrained the staff at the pharmacy at issue. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. OCR only reviewed the evidence submitted pertinent to resolving the issue raised in the complaint. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact William Corriher, Investigator, at (404) 562-7523 (Voice), (404} Sincerely yours, velt man Regional Manager a ?Im?t? II. as? Office of the Secretary DEPARTMENT OF HEALTH HUMAN SERVICES Voice - (404) 5624836. {800) 368-1019 TDD (404) 562-7834, {800) 53?-?69? Fax - (404} 562-?881 Of?ce for Civil Rights, Region IV Atlanta Federal Center 61 St. SW, Suite Atlanta. GA 30303 January 24, 2012 CVS Care . Attn: Privacy Of?cer CVS Drive Woonsocket, R10289S RE: v. CVS Caremark Reference numbers: 1 1-1285 51 {bll?llbl Bi) Dear June 2, 201 l, the U.S. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, the complaint alleges that the CVS Caremark 6 b? n. at 12012 Abercorn Street in Savannah, Georgia confused the medical records of With other patients with the same name. The complaint alleges that A complained to CVS several times about the issue. These allegations could re?ect violations of 45 C.F.R. and OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On November 28, 201 1 OCR noti?ed CVS of the allegations in the complaint. In response, CVS acknowledged that prescription was mistakenly ?lled under another the records of another patient with a similar nam . When informed CVS of the error in April 201 1, CVS said it asologized tolibiimibimm corrected the information in records, and contacted (bliaiibmm insurance to have the claim reversed. The responsible employee was retrained in privacy policies and procedures and issued a ??nal warning? regarding her compliance with policies and procedures. CVS told OCR that the employee left CVS soon afterwards. Upon being noti?ed of investigation, CVS retrained the entire pharmacy staff at the Savarmah pharmacy, even though the responsible employee no longer works there. OCR received documentation of the staff?s retraining. CVS sent OCR copies of its privacy policies and procedures, as well as its procedures for ?lling and dispensing prescription medications. All matters raised by this complaint at the time it was filed have now been resolved through the voluntarv co pliance actions of CVS Caremark. Although a CVS employee mistakenly ?lled prescri] other customer?s name, CVS corrected the information in its system, apologized to We]in sanctioned the responsible employee, and retrained the staff at the pharmacy at issue. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. OCR only reviewed the evidence submitted pertinent to resolving the issue raised in the complaint. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identifies individuais or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact William Corriher, Investigator, at (404) 562-3523 (Voice), (404) Sincerely urs, Regional Manager