Selt?m-e, DEPARTMENT OF HEALTH HUMAN OFFICE or THE SECRETARY Voice - {312} 886-2359 Office for Civil Rights, Region TDD {312} 353?5693 233 N. Michigan Ave, Suite 240 (FAX) - (312} 885-1307 Chicago, IL 60601 August 4, 2011 Andrea Wilson, RHIA, MAM, Privacy Implementation Coordinator VHA Information Access Privacy Of?ce 810 Vermont Ave, NW. Washington, DC. 20420 Re: v. Adam Ben'amin Jr. VA Clinic OCR Transaction Number: 11-12329] Dear Ms. Wilson: On January 19, 2011, the U.S. Department of Health and Human Services HS), Of?ce for Civil Rights (OCR), Region v, received a complaint ?led by the complainant, and alleging that Adam Benjamin, Jr. VA Clinic (VA), the covered entity, violated the Federal Standards for Privacy of Individually Identi?able Health Information and/or the Security Standards for the Protection of Electronic Protected Health Information (45 CPR. Parts 160 and 164, Subparts A, c, and E, the Privacy and Security Rules). Speci?cally,alleges that, in January, March, July, and December of I. an emoloyee of the VA and the case manager of I, impermissiny disclosedlibiimbimm protected health information (PHI) toliblim'ii?mic) former co-worker. This allegation could re?ect a violation of 45 C.F.R. ?164.502(a) of the Privacy Rule. OCR enforces the Privacy and Security Rules, and the Breach Noti?cation Rule, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. OCR has reviewed the matter raised in the complaint. On March 7, 2011, OCR notified the VA of this complaint. On May 12, 2011, the VA provided a written response to OCR, along with supporting documentation. OCR Subsequently received an additional response and supporting documentation from the VA. Based on review of the facts and circumstances of this matter, we have determined that all of the issues raised in this matter at the time it was ?led have now been resolved by the voluntary compliance actions of the VA. Page 2 In its initial response to OCR, the VA inforIHed OCR Iwas the therapist and case manager for The VA stated that became alarmed when missed several appointments. Iacknowledged that she contacted a co-worker of land a friend to to try and determine location and status. The VA stated that Iserved on the interdisciplinary team at the VA and was, therefore, part 0 treatment team. Denise Schafer, an Investigator with OCR, telephoned (bll?llbi?ltC) and inquired about being a part of her treatment team. denied that (bilalulbllil was a part of her treatment team. (Pliei-(Plililm stated that {Elia-{W} was a former co-worker and friend and that (bilelulbilil had never been involved in treatment. On June 10, 2011, Denise Schafer interviewed Ilblt?iibl?nci I that she and were friends and had been co?workers at another VA facility. [further con?rmed that she serves on several interdiscilinary teams at the VA and has worked with on some cases. However, also stated that she had never been a part of (bit?itbl?l treatment team, had never treated her professionally, and does not know I diagnosis. stated that had shared information regarding I case with her and was aware of that fact. con?rmed I contacted her to inquire about the whereabouts and status "(onsiimm said that she contacted Itbit?ltbi??cl Iand informed her I was concerned about her. Itbil?itbi Istated that she did not believe that acted maliciously, but that she understood that the Privacy Rule generally does not permit the disclosure of an individual?s status as a patient of a covered entity, without the individual?s authorization or other permitted or required reason under the Rule for doing so. On June 10, 2011, Denise Schafer also contacted Vicki Bowman, the Privacy Officer at the VA. Ms. Schafer provided technical assistance to Ms. Bowman regarding the disclosure of Ms- Schafer informed Ms. Bowman that, in spite of information provided to OCR by the VA, Emmi-{W} Istated that she had never been a part of treatment team. Ms. Schafer also informed Ms. Bowman that if the VA continued to label employees of the facility as part of the interdisciplinary team when in fact the employee was not involved in a patient?s treatment plan, then the VA would continue to have compliance issues with the Privacy Rule. Ms. Bowman assured Ms. Schafer that she understood and would further address this issue. Generally, the Privacy Rule regulates the uses and disclosures of PHI. 45 C.F.R. 164.502. It does so, in part, by permitting or requiring certain uses or disclosures of PHI by a covered entity, and for all other purposes, requiring that a covered entity obtain the individual?s valid authorization prior to use or disclosure. 45 CPR. 164.502(a) and For example, some of the permitted bases for using or disclosing PHI is for treatment, payment, or health care operations. 45 C.F.R. 164.502 (1) To resolve this matter the VA took the following voluntary compliance actions: 1) verbally counseled and lregarding this issue; 2) provided OCR with a copy of its uses and disclosures po icies and procedures which generally comport to be in compliance with Page 3 the requirements of the Privacy Rule. 0n Julv 19. 201], the VA provided Ms. Schafer with documentation that on one 13, 201 1 had been retrained regarding this issue. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect infermation that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please contact Denise Schafer at (312) 353-0752 (Voice) or (312) 353-5693 (TDD). Sincerely, . Celeste H. Davis Acting Regional Manager