OFFICE OF THE SECRETARY Of?ce for Civil Rights, Region IV 61 Street, SW. Atlanta Federal Center, Suite 16TH) Atlanta, GA 30303?8909 DEPARTMENT OF I-EEALTHEL HUMAN SERVICE Voice - (404} 562-3385, (800) 368-1019 TDD - (404) 5624334, (300) 531769? (FAX) (404} 562-?881 ilk Han July 17, 2014 {b lt?iibltfitci CVS Caremark One CV3 Drive, Mail code: 1160 Woonsocket, RI 02895 ?Emmi Iv. CVS Caremark OCR Reference Number: 13-167573 6. Dear{ it 3.0330303) and On September 20, 2013, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy.r of Individually identi?able Health Information the Security Standards for the Protoction of Electronic Protected Health Information (45 CPR. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Noti?cation Rule Subpart - Notification in Case of Breach of Unsecured Protected Health Information (PHI) (45 C.F.R. Re: Specifically, Complainant, alleges that Caremark (CVS) violated the privacy rights of herself and her husband when on September 2, 2013; CVS refused to provide the Complainant and her husband with complete copies of their prescription and billing history upon her request and has failed to provide a written denial of her request. Complainant further alleges that CVS removed her prescription history from the online web portal. These allegations could re?ect potential violations of 45 C.F.R. Noti?cation Rules, and also enforces Federal the delivery of health and human services age, and under certain circumstances, sex and OCR enforces the Privacy, Security, and Breach civil rights laws which prohibit discrimination in because of race, color, national origin, disability, religion. 45 C.F.R. 164.524 provides individuals with a right of access to inspect their PHI for as long as the PHI is maintained in their designated record set. The Privacy Rule at and obtain a copy of OCR Reference Number 13-1675? 3 Page 2 of 2 On March 12, 2014, OCR provided notice to and requested data from CVS. On April 22, 2014 and May 13, 2014, CVS provided its response to OCR. In response to' the allegations, CVS reports that it has not received a written request for access from Complainant or her husband. Complainant advised that her attempt to submit a written request for access at the CVS store location was refused. On June 23, 2014, OCR provided technical assistance to Complainant regarding process for requesting access to PHI as described in Notice of Privacy Practices. CVS then assured OCR that upon receipt of Complainant?s request for access, it will comply in a timely manner by providing the requested access. OCR notes that Complainant may submit a subsequent complaint to OCR if, after completing the appropriate process for requesting access, CVS does not provide access within 30 days of your request. As of part of this review, OCR obtained policies and procedures related to the cited Privacy Rule provisions, as well as documentation related to training if its employees on the HIPAA Privacy Rule. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Sonya Hanafi at (404) 562-7865 (Voice) or (404) 562- ?884 (TDD). Sincerely, thy No nan Regional Manager Of?ce for Civil Rights