OFFICE OF THE 
Of?ce for Civil Rights, Region 
233 N. Michigan Ave, Suite 23?40
Chicago, IL 60601 

DEPARTMENT OF HEALTH 3: HUMAN SERVICES
Voice - (312) 836-2359

TDD - (312} 353-5593

- (312) 8364 so?

April 17, 2012

 



 

 

 

 

:{blt?iibltii asde

Andrea Wilson, RHIA, MAM, CIPPIG
Privacy Implementation Coordinator

VHA Information Access Privacy Of?ce
Department of Veterans A?airs

Veterans Health Administration
Washington DC 20420

 

.

of Veterans A??m
OCR Transaction Number: I 1-125515

Dear 

Ms. Wilson:

Re:

On March 22, 2011, the US. Department of Health and Human Services S), Office for (Civil
Rights (OCR), Region V, received a complaint filed by the Complainant,} and
alleging that the Department of Veterans Affairs (VA) located in Milwaukee, Wisconsin; the
Covered Entity, has violated the Federal Standards for Privacy of Individually Identi?able
Health Information andfor the Security Standards for the Protection of Electronic Protected
Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security
Rules). Speci?cally, stated that she is employed by the VA facility in Green Bay,
Wisconsin and that she is a patient of the VA in Milwaukee, Wisconsin. alleged that,
on March 7, 2011, Ian employee of the VA in Milwaukee, Wi Esin
impermissiny disclosed protected health information (PI-II) to her mothe

(WSW) who is emlo ed the VA in Green Ba Wisconsin. According to {blisliblmicl
{blieliblmicl to confirm whether (?Haliblmicl had undergone an ectlve -..: 
procedure. {bli?libliili?ll asserted that inquiry and disclosure were unrelated to

Iprofessiona] duties and responsibilities and was based on
knowledge thathlinli?i'licl Iwas her mother. This allegation could re?ect a violation o. 45
164.502. 

 

 

 

OCR enforces the Privacy and Security Rules, and the Breach Noti?cation Rule, and ialso
enforces Federal civil rights laws which prohibit discrimination in the delivery of health! and
human services because of race, color, national origin, disability, age, and under certain
circumstances, sex and religion. 

 

 

Page 2 and Andrea Wilson

 

 

 

OCR has reviewed the matter raised in the complaint. OCR has interviewed the Complainant
and has reviewed the supplemental information that she provided to OCR. On June 21, lel l,
and in response to subsequent data requests, the VA provided a written response and an i . in
documentation to OCR. In its response to OCR, the VA acknowledged that
impermissibly disclosed PHI as alleged. Based on our review of the factsl-and
circumstances of ?ris matter, we have determined that all matters raised by this complaint the
time it was ?led have now been resolved through the voluntary compliance actions of the VAL.


According to the Privacy Rule, a covered entity may use or disclose PHI only as permittdd or
required by the Privacy Rule. 45 CPR. In this case, the evidence shows, by a
preponderance, that the disclosure was not for a permitted or required purpose. 

To resolve the issues raised in this matter, the VA took the following voluntary actions: 
counseled regarding appropriate uses and disclosure of 2) requiredl
be proctored under the Chief Social Work Executive to ensure practicel and
privacy measures are met; 3) documented the disclosure in accordance with 45  
4) informed (gambit?) that she could elect a different primary care physician;
and S) apologized tollbliellblillicl  for the impermissible disclosure. The VA also submitt its
policies and procedures for using and disclosing PHI. OCR has determined that these pol. ies
and procedures generally comport with the requirements of the Privacy Rule. 2

Based on the foregoing, OCR is closing this case without further action, effective the date oil this
letter. determination as stated in this letter applies only to the allegations inl this
complaint that were reviewed by OCR. 1

Under the Freedom of Information Act, we may be required to release this letter and dther
information about this case upon request by the public. In the event OCR receives suich a
request, we will make every effort, as permitted by law, to protect information that identi?es
individuals or that, if released, could constitute a clearly unwarranted invasion of personal
privacy. 1

If you have any questions regarding this matter, please contact Cassandra Grif?n, Investigatdr, at
(312) 353-0911 (Voice) or (312) 353-5693 (TDD). 

Sincerely,

 

Celeste H. Davis
Regional Manager