gm?? el?ume DEPARTMENT OF HEALTH sermons OFFICE OF use Voice - {214) rat?sore. taco) sea-1019 Too- (214;- mrosto mace for (its Rights, Region v1 as, - (21o 78T-tl432 1301 Young Street, State 1169 Dallas, TX 75202 2 3 ran ?vacyDirector CV8 Carernark 9501 E. Shea Scottsdale, AZ 35250 Transaction Number: 11-12632? (strenuous: On April 13, 2011, the Of?ce for Civil Rights loos) received a complaint from alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Infonnation andlor the Security Standards for the Protection of Electronic Protected Health ln?mna?tion (45 CPR. 160 and 154 Sn arts A, C, and E, the Privacy and Security Rules). Speci?callyJEllgli-Ei? 5m Ialleges CVS Caremarlr faxed the protected health information of a patient with whom lhas no n-eannent relationship, to his of?ce. These allegations could reflect violations of 45 C.F.R. 164.502(a) and H3) OCR enforces the Privacy and Security Rules and also enforces federal civil rights laws which prohibit discrimination in the deliveryr of health and human services because of race, color, national origin, disability and age. OCR noti?ed CV3 Carernark of the complaint on inlayr 9, 2011 and reviewed subsequent reaponse. CV conducted an internal investigation into the complaint and achtowledged that prescription information was inadvertently sent to rather than to the intended physician Upon being noti?ed by OCR of the incorrect disclosure, CVS Retail reassigned the patient?s prescriptions to the correct 'ci - land reviewed all prescriptions assigned to - Mia-lbw?) at store 6967 to ensure they were assigned to the correct physician. CV provided additional HIPAA training to the employees of the involved store. As part of our investigation, OCR further reviewed written assurance that CV3 Retail is implementing additional safeguards to prevent such future recurrences. in their response to OCR. dated June 3. 2011, CVS explained that under the new process, the retail pharmacies will no longer be able to search by prescriher name Ahoy will need to search 1 1425327 2 by DEA or NPI number. On 5 ember 28, 2011, the investigator contacted by telephone. {misliblmicl n?rmed that he had not received an}!r further incorrect faxes ?orn CV8. All matters raised by this complaint at the time it was ?led have now been resolved through the vohmtary compliance actions of CVS. Therefore, OCR is closhtg this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, it may be necessary for OCR to release this document and related correspondence and records upon request. In the event that OCR receives such a rcquesL we will seek to protcct, to the extent provided by law, personal information which, if released, would constitute an unwarranted invasion of privacy. If you have an};r questions, contact Jamie Scrley, Investigator, at (214) 767-3903 (Voice), (214} 767-8940 (TDD). Sinotnely, Ralph D. Rouse Regional Manager