DEPARTMENT OF HEALTH 8: HUMAN SERWCES OFFICE OF THE SECRETARY Voice - (214} 767-4056. (acoisce1 019 TDD - (214) Of?ce for Civil Rights, Raglan VI (FAX) - {214) T674432 1301 Young Street, Suite 1169 Dallas, TX 75202 14 2013 {bli?liblii?licl Ms. Andrea Wilson, RHIA, CIPP, CIPPKG VHA Privacy Implementation Coordinator Infomration Access and Privacy Of?ce - Department of Veterans Affairs - Veterans Health Administration 310 Vermont Avenue, N. W. Washington, DC 20420 Our Reference number: 13-149985 Dear (humiblmm and Ms- Wilson: On October 2012, the Of?ce for Civil Rights (OCR) received a complaint from Eddie A. Roman alleging a violation of the Federal Standards for Privacy of Individually Identi?able Health Information andt'or the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rides). Speci?cally, alleged that on or about October 3, 2012, when he visited the Military Sexual Trauma linic 'he was -uired to sign-in on a cli board; alleged that despite his objections, the clerk required to put the reason for the visit on the sign-in sheet which was visible to other visitors. ?arther alleged that he and his wife were required to wear visitor badges with written on them to visit the clinic. These allegations indicated potential violations of 45 CPR. 164.514(d) and OCR enforces the Privacy and Security Rules and also enforces federal civil rights iaws which prohth discrimination in the delivery of health and human services because of race, color, national origin, disability and age. On January 10, 2013, OCR noti?ed the Veteran?s Health Administration Privacy Of?ce of complaint. In a response to OCR received February 4, 2013, the VHA provided documentation of its internal investigation and acknowledged it had found the complaint to be valid. The van explained that it had investigated the matter after ontacted the facility Patient Advocate regarding the issue on October 4, 2012. At the time, the MST clinic was meeting in the Domiciliary due to a lack of space in the main facility. In an effort to limit unnecessary visitors to the Domiciliary area, visitors were required to check-in with the clerk and obtain an access badge to 13-149935 2 enter the Domiciliary. During visitl the clerk had written the name of the particular clinic, the MST clinic, on the badge to indicate that the patient and visitor were approved to enter the Domiciliary area. However, the VHA reported it was not the facility?s practice to identify the speci?c program visited on the visitor?s badge or require that information on the sign-in sheet. At the time of complaint to Patient Advocate, the Facility Privacy Of?cer apologized to met with the SATP Program Manager regarding the incident and enameled the involved clerk regarding protecting sensitive information. During this investigation, OCR reviewed documentation that the facility took the corrective action of revising the patient sign-in sheet and visitor badge system. The VHA educated workforce members on the revised process during a staff meeting on October 10, 2012. On March 12, 2013, OCR interviewed two of the workforce members who completed the additional training, continuing the implementation of the revised check-in process. OCR further reviewed documentation that the VHA provided a breach noti?cation letter to on October 12, 2012 and ?led a breach noti?cation report with the *E'tecretarpr of the US. Department of Health and Human Services on October 24, 2012. All matters raised by this complaint at the time it was ?led have now been resolved through the voluntary compliance actions of the Veterans Health Administration. Therefore, OCR is closing this case. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of information Act, it may be necessary for OCR to release this document and related correspondence and records upon request. In the event that OCR receives such a request, we will seek to protect, to the extent provided by law, personal information which, if released, would constitute an unwarranted invasion of privacy. If you have any questions, contact Jamie Sorley, Investigator, at (214) 767-8908 (Voice), (214) 767- 8940 (TDD). Sincerely, Jo . zano Regio Manager