I 1allI ?to ?90 Hun-1, OFFICE OF THE SECRETARY Of?ce for Civil Rights, Region IV 61 Street, S.W. Atlanta Federal Center, Suite 16T7l) Atlanta, GA 30303?3909 DEPARTMENT OF HEALTH HUMAN SERVICES Voice - {434} 532-7333. {500) 333-1013 TDD - {404) 532-7334. {300) 53?-?69? {404) 562-7331 September 30, 2013 OCR Transaction Number: 11-123444 Re: Dear On February 9, 2011, the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR), received your complaint alleging that Womack Medical Center, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information andior the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 150 and 154, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Noti?cation Rule Subpart - Notification in Case of Breach of Unsecured Protected Health Information (45 C.F.R. Speci?cally, you allege that Womack Medical Center (hereinafter, impermissibly disclosed Iprotectecl health information when on January 25, 2011, its Freedom of Information Act office provided Complainant with a copy of Complainant's medical record, which included PHI belonging medical record. Hence, the complaint alleges that WMC commingled Complainant's medicai records with Imedical records, in which you received a copy without any prior authorizations. In addition, the complaint further alleges that WMC may not have in place an adequate internal HIPAA complaint procedure, and also that it may fail to mitigate any harmful effects resulting from similar incidents. These allegations could reflect potential violations of 45 C.F.R. and respectively. Thank you for bringing this matter to OCR's attention. Your complaint is an integral part of enforcement efforts. OCR enforces the Privacy, Security, and Breach Notification Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. We have reviewed your complaint and have determined that OCR will not investigate your allegations. Therefore, OCR is closing this complaint with no further action, effective the date of this letter. determination as stated in this applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we wit! make every effort, as permitted by law, to protect information that identifies individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. We regret we are unable to assist you further. Thank you. Sincerely, ?u Ada/W Frank 0. Campbell Acting Regional Manager Region IV OFFICE OF THE SECRETARY Of?ce for lCivil Rights, Region IV 61 Street,- SW. Atlanta Federal Center, Suite Atlanta, GA 30303-8909 DEPARTMENT OF HEALTH HUMAN SERVICES Voice - {404) 552-?386, (300} 363-1019 TDD - {404} 562-7334, (300] 53-3769? (404} 562-7381 . vfocrf September 30, 2013 Ms. Linda Thomas, Director Office of the Assistant Secretary of Defense Health Affairs Tricare Management Activity Skyline Five, Suite 810, 5111 Leesburg Pike Falls Church, VA 22041-3206 vs. Womack Medical Center OCR Reference Number: 11-123444 Re: Dear Ms. Thomas: [in February 9, 2011, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR), received a complaint alleging that Womack Medical Center, the covered entity, has violated the Federal Standards for Privacy of Individually Identifiable Health Information andIOr the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules), and the Breach Noti?cation Rule Subpart - Noti?cation in Case of Breach of Unsecured Protected Health Information (45 C.F.R. ees that Womack Medical Center (hereinafter, imp protected health information when its Freedom of Information Act of?ce provided Complainant with a copy of Complainant's medical record, which included PHI belonging to libil?iibiliilci Imedical record. Hence, the complaint alleges that WMC commingled Complainant's medical records with libil?lxlbili?llci Imedical records, in which Complainant received a copy without any prior authorizations. In addition, the complaint further alleges that WMC may not have in place an adequate internal HIPAA complaint procedure, and also that it may fail to mitigate any harmful effects resulting from similar incidents. These allegations could reflect potential violations of 45 C.F.R. and respectively. Specifically Complainant, all OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. We have reviewed the complaint and have determined that OCR will not further investigate these allegations. TherefOre, OCR is closing this complaint with no further action, effective the date of this letter. determination as stated in this applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. Sincerely, Frank 0. Campbell Acting Regional Manager Region IV