e?

?r


it




game;

DEPAEMNT 0F I-IEAI..TH 8; HUMAN SERVICES
1Home (21 4] l??7-4tl5?. (BUG) 353-1 D19 TDD {214) ?ll-3ng
- [214) T610432 

"are

OFFICE OF THE SECRETARY

Of?ce for Civil Rights, Region VI
1301 Young Street, Suite 1169
Dallas, TX 75202

APR 02 2012.

 



 

 

 

On his 3 2011, the Of?ce for Civil Rights (OCR) received a complaint t?ro
detonators

{blt?ttolti?ltcl Privacy Director

CVS Carernark
9501 E. Shea
Scottsdale, AZ 85260

Transaction Number: 1 1- 1 2 3148

 

Dear {bll?libllTIlC-l and {bl{El,{bl{ l?l

 

 

 

 



 

 

 

alleging a violation of the Federal Standards for Privacy of Individually
Identi?able Health Information andi'or the Security Standards for the Protection of
Electronic Protected Health Information (45 CPR. Parts 160 and 164, Suhparts A, C, and
E, the Privacy and Security Rules). Speci?cally, I alleges CV3
Carctnark disclosed the protected health information of 
of individuals with whom Ihas no pattenp?rovider
relationship, when CV Caretnark fasted the protected health information 2011. A copy of these faxes was attached to the October
11, 201 1 letter for your reference. This allegation could re?ect violations of 45 CPR. 
164.502(a) and 

 

OCR enforces the Privacy and Security Rules and also enforces federal civil rights laws
which prohibit discrimination in the delivery of health and human services because of race,
color, national origin, disability and age.

OCR noti?ed CVS Caremark of the complaint on October ll, 2011 and reviewed
CVS's subsequent response. CVS conducted an internal investigation into the complaint
and acknowledged that {mill-(Mimic) I prescription information was
inadvertently sent to rather than to the intended physician. Upon
being noti?ed by OCR of the incorrect disclosure, CVS Retail reassigned the patient?s
prescriptions to the correct physician,  {blt6l{bl{?l{6l and required the employees
at store #7643 and store to complete additional training.

 

 

11-127148 2

As part of our investigation, OCR further reviewed written assurance that CVS
Retail has since implemented additional safeguards to prevent such ?lture recurrences.
system now requires that a physician be searched by DEA or NPI number, not
physician name.

All matters raised by this complaint at the time it was ?led have now been resolved through
the voluntary compliance actions of CVS. Therefore, OCR is closing this case. 
determination as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR.

Under the Freedom of Information Act, it may be necessary for OCR to release this
document and related correspondence and records upon request. In the event that OCR
receives such a request, we will seek to protect, to the extent provided by law, personal
information which, if released, would constitute an unwarranted invasion of privacy.

If you have any questions, contact Jamie Sorley, Investigator, at (214) 767-8908 (Voice),
(214) 767-8940 (TDD).

Sincerely

. 

"Ralph D. Rouse
Regional Manager