Voice (214} 7 4055, (300} 363-1019 TDD - {214} YET-3940 I I - {214} rev-one Office for Civil Rights, Region VI 1301 Young Street, Suite 1169 Dallas, TX 75202 APR 0 9 2013 Ms. Andrea Wilson, RHIA, CIPPIG VHA Privacy Implementation Coordinator Information Access and Privacy 0f?ce?10P2C] Deparhnent of Veterans Affairs-Veterans Health Administration 310 Vermont Ave, NW Washington DC 20420 Transaction number: 12-14722? Dear Ms. Wilson: 011 August 9, 2012, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging that Central Texas Veterans Health Care System, Olin E. Teague (Central Texas), covered entity, has violated the Privacy andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Snbparts A, C, and E, the Privacy and Security Rules). Speci?cally, (complainant) alleges that she spoke to a Patient Representative, about a clerk who was violating a patient's privacy. later went into the complainant's medical record and disclosed the information to the clerk without authorization. This allegation could re?ect violations of 45 C.F.R. 164.502 Uses and disclosures and .164.530(c) Safeguards. OCR enforces the Privacy and Security Rules, and also enforces Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. On February 13, 2013, OCR noti?ed the Deparmient of Veterans Affairs, Veterans Health Administration of the complaint. On April 2, 2013, OCR received a response which included copies of their investigation, from libli?liblii?licl IVHA Privacy Specialist, on behalf of Central Texas. On April 13, 2012, Central Texas initiated an internal investigation when the complainant noti?ed them of her concerns. Their ?ndings revealed that accessed the records two separate times on April 13, 2012. In an effort to take corrective action, Central Texas sanctioned for improperly accessing the complainant?s records without a need to know. Central Texas conducted staff retraining on March 12 13, 2013, speci?cally addressing the patient representatives accessing Page 2 of 2 (12-14722?) patient?s PHI. Central Texas noti?ed the complainant of their ?ndings in a letter dated May 21, 2012. Additionally, Central Texas noti?ed OCR of the breach on May 29, 2012. As part of our investigation, OCR reviewed Central Texas?s policies speci?c to this complain and found them to be in compliance with the Privacy Rule. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of Central Texas Veterans Health Care System. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identifies individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions, please contact Debbie Campos, Investigator, at (214) 767-1837 (Voice), (214) 767-8940 (TDD), or E-mail to: Debbie.Cam s. ov. Sincerely, Jorge A. Lozano Regional Manag