DEPARTMENT or HEALTH 5.: ERVICES OFFICE or THE REva Voice - [214] T674053. 363-1 01 9 TDD - (214) t, - {214) Tor-0432 Of?ce for Civil Rights, Region VI 1301 Young Street, Suite 1169 Dallas, TX 75202 JUL 1 6 20h Ms. Andrea Wilson, RHIA, CIPP, CIPPIG VHA Privacy Implementation Coordinator Information Access and Privacy Of?ce? Department of Veterans Ariana-Veterans Health Administration 810 Vermont Ave, NW Washington DC 20420 Transaction number: 12-141681 ear and Ms. Wilson: On March 31, 2012, the LLS. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging that Alexandria VA Health Care System (Alexandria VA) in Pineville, Louisiana is in violation of the Federal Standards for Privacy of hidividually Identi?able Health Information and/or the Security Standards for the Protection of Electronic Protected Health Information (45 CPR. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, [(complainant) alleges that she received a noti?cation letter stating that the Alexandria VA detennined that two employees had accessed her information. These allegations could re?ect violations 01?45 C.F.R. 164.502 Uses and Disclosures and 164.530(c) Safeguards, respectively. OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On May 14, 2012, OCR notified Ms. Wilson at the Department of Veterans Affairs of the complaint. On June 21, 2012, OCR received a response ??om Vicki Bowman, VHA Privacy Specialist, on behalf of Alexandria VA. Their ?ndings revealed that on December 3, 2011, the complainant contacted the Privacy Of?cer to initiate a complaint. Alexandria VA began an internal investigation and provided OCR with copies. Three employees were found to have accessed the complainant?s record, but it was determined by the Privacy Officer that one was related to patient care. The Privacy Of?cer interviewed the remaining two employees and determined that they inappropriately accessed the complainant?s record without a need to know. Page 2 of2 (12?141681) Alexandria VA has taken voluntary steps to resolve this matter. Alexandria VA sanctioned the employees that inappropriately accessed the complainant?s record and required the employees to complete retraining. Alexandria VA noti?ed the Secretary of HHS of the Breach on March 2, 2012 and provided OCR with a copy. Further, Alexandria VA, send a noti?cation letter to the complainant that included a free credit reporting. As part of our investigation, OCR reviewed Alexandria policies and found them to be in compliance with the Privacy Rule. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of Alexandria VA. Therefore, OCR is closing this case. OCR's determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Debbie Campos, Investigator, at (214) 7'67?1837 (Voice), (214) 767-8940 (TDD), or E-mail to: Debbie.Campos@hhs.gov. Sincerely, 69%m Ralph D. Rouse Regional Manager