DEPARTMENT OF HEALTH 6: HUMAN SERVICES OFFICE OF THE SECRETARY

 

 

 

Voice - {214) reasons. [soc] 1019 TDD . {214) 2613940 O?ce for (Evil Rights, Region VI
FAX . yer-0432 Wm 130115;.ng Street, Suite 1169
Dallas. TX 75202
MAY 0 9 2012
(bli?liblil?licl

 

 

 

Ms. Andrea Wilson, RHIA, CIPP, 

VHA Privacy Implementation Coordinator
Information Access and Privacy 
Department of Veteran Affairs-Veteran Health Admin.
810 Vermont Avenue, N.W.

Washington, DC. 20420

Our Transaction Number: 11-12992?

Re: Raymond G. Murphy VA Medical Center, 1501 San Pedro Ave SE, Albuquerque, NM
87108

Dear {bllmibm and Ms. Wilson:

The US. Department of Health and Human Services (HHS), O?ice for Civil Rights (OCR) has
completed its investigation of the above-entitled complaint ?led by Iagainst
the Raymond G. Murphy VA Medical Center (the OCR is responsible for determining
the compliance status of covered entities with the Federal Standards for Privacy of Individually
Identi?able Health Information andfor the Security Standards for the Protection of Electronic
Protected Health Information (45 CPR. Parts 160 and 164, Subparts A, C, and E, the Privacy
and Security Rules). The complaint, received by OCR on July 2011, alleges a workforce
member of the Raymond G. Murphy Medical Center accessed the protected health information

 

 

 

oflibli?libliilic) lavers that she requested a Patient Access orthelease of
Information (the ?report") on May 23, 2011. Upon receipt of the report, discovered
that her supervisorl'ibll?libliillcl I accessed her PHI on two occasions. alleges

 

that there is no reason, recognized by the Privacy Rule, why her supervisor should have accessed
her PHI. OCR has reviewed all of the evidence presented in reference to the issue addressed in
the complaint. This letter explains determination.

OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws that
prohibit discrimination in the delivery of health and human services because of race, color,
national origin, disability, age, and, under certain circumstances, sex and religion.

On April 4, 2012, OCR noti?ed the VA of the complaint. In its response, the VA admitted that
supervisor did in fact access her PHI inappropriately. Because of the
aforementioned, the VA:

1. Counseled supervisor verbally;

 

2. Sanctioned Wis suspension;
3. Reported the breach of i i PHI to the Of?ce of the Secretary as required by

the Breach Noti?cation Rule, and;
4. Mailed a letter about the breach on April 30, 2012.

 

 

OCR reviewed the policies and procedures of the VA and found the policies and procedures as
submitted to be adequate to protect the privacy of PHI. All matters raised by this complaint at
the time it was ?led have now been resolved through the voluntary compliance actions of the
ergo, OCR is closing this case. determination as stated in this letter applies only to
the allegations in this complaint that were reviewed by OCR.

Under the Freedom of Information Act, we may be re?luired to release this letter and other
information about this case upon request by the public. In the event OCR receives such a
request, we will make every effort, as permitted by law, to protect information that identi?es
individuals or that, if released, could constitute a clearly unwarranted invasion of personal
privacy. If you have any question regarding this matter, please contact Vaniecy Nudgwe,
Investigator, 2112144674054 (Voice), 214-767-8940 (TDD).

Sincerely,

Ralph Rouse
Regional Manager
Region VI