in

i 
a HUMAN SERVICE OFFICE OF THE SECRETARY
- - . 3-1019 i
"m TDD - (404} 562-7334, (300} 537-7697  Raglan Iv
FAX 404 552-7 1 i 
j} gm. Atlanta Federal Center, Suite 16170
_n9__s_mw Atlanta, GA 30303-8909
September 15, 2014
(cashmere)

 

 

m: dvisor
CVS Caremark

One CVS Drive
Woonsocket, R1 02895

OCR Reference number: 12?135805

 

and 

 

 

Dear

 

On November 30, 2011, the US. Department of Health and Human Servipes (HHS), Office for
Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for
Privacy of Individually Identi?able Health Information and/or the Security Standards for the
Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A,
C, and E, the Privacy, Security, and Breach Noti?cation Rules), and the Breach Noti?cation
Rule Subpart - Noti?cation in Case of Breach of Unsecured Protected Health Information
(PHI) (45 CPR. 

Speci?cally, the complaint alleges that CVS Caremark Store Number 284512 (CVS)
impermissiny disclosed the PHI of Complainant, when on November 4, 2011, a
substitute pharmacist and a pharmacy technician discussed Complainant?s PHI with other staff
members who were not involved in the Complainant?s care and within earshot of other CV8
customers. Complainant further alleges that he made a complaint with CVS management, which
was not adequately addressed. These allegation could re?ect a potential violations of 45 C.F.R

and 

 

OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also enforces Federal
civil rights laws which prohibit discrimination in the delivery of health and human services
because of race, color, national origin, disability, age, and under certain circumstances, sex and
religion.

 

 

Under the Privacy Rule at 45 C.F.R. a covered entity may not use or disclose PHI,
except as permitted or required by the Privacy Rule. 45 C.F.R. requires a
covered entity to identify those people who need access to PHI and the type of PHI to which they
need access and to make reasonable efforts to limit such access to that information.

Additionally, under 45 C.F.R. a covered entity must have in place appropriate
safeguards to protect PHI. Finally, under 45 C.F.R. ?164.530(d) a covered entity must provide a
process for individuals to make complaints about a covered entity concerning its policies and
procedures andfor its compliance with the Privacy Rule.

On June 12, 2013, OCR noti?ed CVS of the complaint. In response to the allegations, CV3
reported that while it did receive a complaint from Complainant, in his complaint did
not raise any issue regarding the discussion of his PHI with staff members unnecessarily or
within earshot of others. CVS reports that rather only voiced his complaint
regarding the refusal of the pharmacist to provide him with a ?u shot. Nevertheless, CVS reports
that despite being unable to substantiate Complainant?s claim that the staff members discussed
his PHI in violation of his privacy rights, CVS provided evidence that it retrained its staff at the
pharmacy regarding these issues. CVS also issued an apology to 

 

 

 

 

Upon review of the documentation, OCR determines that all matters raised by this complaint at
the time it was ?led have now been resolved through the voluntary compliance actions of CVS.
Therefore, OCR is closing this case. determination as stated in this letter applies only to
the allegations in this complaint that were reviewed by OCR. Please note that OCR Reference
Number 14-187146 regarding Complainant?s civil rights concerns remains open until further
notice.

Under the Freedom of Information Act, we may be required to release this letter and other
information about this case upon request by the public. In the event OCR receives such a request,
we will make every effort, as permitted by law, to protect information that identi?es individuals .
or that, if released, could constitute a clearly unwarranted invasion of personal privacy.

If you have any questions, please do not hesitate to contact Sonya Hana?, Investigator, at (404)
5624865 (Voice) or (404) 562-7834 (TDD)

Sincerely,

Timothy Noonan
Regional Manager
Of?ce for Civil Rights