f? Indiana 6-, ?mm. M, DEPARTMENT OF HEALTH HUMAN SERVICES OFFICE OF THE SECRETARY Voice- (215) 8514441 Of?ce for Civil Rights, Region TDD (215) 351-4440 150 S. Independence Hall West FAX - (215] 351-4431 Public Ledger Building, Suite 3?2 hh . Philadelphia, PA 19106-3499 Reference: 152710 Investigator: Elizabeth Benson Contact Telephone: 215?861-4427 April 16,2013 Sr. Privacy Consultant CVS Careka 9501 East Shea Blvd. Scottsdale, AZ 85260 {bli?llbli?l?llCl Dear Dear The Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint on December 11, 2012, alleging that CVS Pharmacy Store Number 1393, the covered entity, is not in compliance with the Federal Standards for Privacy of Individually Identi?able Health Information andr?or the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). The complainant, l, alleged that the covered entity had failed to amend her electronic prescription history. Speci?cally, Ialleged that on November 16, 2012, she became aware that CVS was including ermneous prescription information in her electronic prescription history. She further alleged that she informed CVS of the error and requested that her records be amended and, after multiple contacts with store personnel as well as customer service representatives, most of the erroneous information was removed. However, as of February 25, 2013, one incorrect entry remained (prescription number This allegation could re?ect a violation of 45 C.F.R. amendments. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. Upon noti?cation of the complaint, CVS conducted an internal investigation to determine if erroneous information was actually included in the complainant?s prescription history. CVS noti?ed OCR that its internal investigation revealed that a mismatch of similar names with matching prescriptions was the cause of the error and that the error had been corrected. On April 4, 2013, OCR contacted the complainant and instructed her to review her electronic prescription history to determine if the information had been corrected. At that time, OCR learned that incorrect information remained on the complainant?s electronic history. OCR followed up with CVS. The covered entity researched the error and determined that while the information had been amended on the pharmacy side it had not been corrected on the Caremark. The covered entity then took action to update the CVS?Caremark information to match the CVS pharmacy information. On April 16, 2013, CVS advised OCR that all of the complainant?s electronic ?les had been amended to re?ect the correct protected health information. OCR contacted the complainant to determine if the updates had taken effect. The complainant noti?ed OCR that all erroneous prescription information had been removed from her electronic ?le. Based on the actions of the covered entity OCR considers this matter resolved and is closing this complaint. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please contact Elizabeth Benson, Investigator, at (215) 861-4427 (Voice) or (215) 861-4440 (TDD). Barbara Ho land Regional ger