WE DEPARTMENT OF HEALTH 6; HUMAN SERVICES Of?ce of the Secretary 5 voice - (214} YET-4056, (sea) see-1019 Of?ce for Civil lagers, Region v: '5 TDD - (214) rev-3940. (eon) ear-rear 1301 Young Street, Suite 1169 Fax {214} rev-0432 Dallas, Tx rezoz {blt?libltiltcl 959302013 Our Transaction Number: 13-150374- m3r (brarbitotci On October 23, 2012, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR), received your complaint alleging that El Paso VA Health Care System, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, you allege that you have requested the covered entity to amend your medical records removing the ?ag for ?drug seeking behavior?, but have not received a response. This allegation could re?ect a violation of 45 C.F.R. 164.526. Thank you for bringing this matter to attention. Your complaint is an integral part of enforcement efforts. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. The Privacy Rule states that an individual has the right to have a covered entity amend protected health information (PHI) or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. 45 C.F.R. 164.526 The covered entity must act on the individual?s request for an amendment no later than 60 days a?er receipt of such a request. If the covered entity denies the requested amendment, in whole or in part, the covered entity must provide the individual with a timely, written denial. We have carefully reviewed your complaint against El Paso VA Health Care System and have determined to resolve this matter informally through the provision of technical assistance to El Paso VA Health Care System. Should OCR receive a similar allegation of noncompliance against El Paso VA Health Care System in the nature, OCR may initiate a fennel investigation of that matter. For your informational purposes, OCR has enclosed material regarding the Privacy Rule provisions related to your right to amend your medical records. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as pennitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please contact Debbie Campos, Investigator, at (214) 767-3595 (Voice) or (214) ?67-8940, (800) Sincerely, Enclosure: Amendment of Protected Health Information Amendment of Protected Health Information The Privacy Rule states that an individual has the right to have a covered entity amend protected health information (PHI) or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. 45 C.F.R. 164.526 The covered entity must permit an individual to request that the covered entity amend the PHI maintained in the designated record set, and the covered entity may require individuals to make requests for amendment in writing and to provide a reason to support a requested amendment, provided that it informs individuals in advance of such requirements. 45 C.F.R. 164.526 The covered entity must act on the individual?s request for an amendment no later than 60 days after receipt of such a request. 45 C.F.R. 164.526 If the covered entity is unable to act upon the request within this time period, it may extend the time for such action by no more than 30 days, provided that the covered entity, no later than 60 days after receipt of the request, provides the individual with the reason(s) for the delay in writing and the date by which it will complete its action on the request. The covered entity may have only one such extension of time on a request for an amendment. The covered entity may respond to an individual?s request for an amendment by either accepting or denying the requested amendment. If the covered entity grants the requested amendment, in whole or in part, the covered entity must make the amendment to the affected records, in the manner prescribed at 45 C.F.R. inform the individual, in the manner prescribed at 45 C.F.R. and make reasonable efforts to inform certain other individuals of the amendment, in the manner prescribed at 45 C.F.R. The covered entity may deny the request for an amendment if it determines that the PHI or record that is the subject of the request is not part of the designated record set; would not be available for inspection under 45 C.F.R. 164.524 (access of individuals to protected health information); is accurate and complete; or was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment. 45 C.F.R. If the covered entity denies the requested amendment, in whole or in part, it must provide the individual with a timely, written denial. The denial must be in plain language and contain: 1) the basis for the denial; 2) the individual?s right to submit a written statement disagreeing with the denial and how the individual may ?le such a statement; 3) a statement that, if the individual does not submit a statement of disagreement, the individual may request that the covered entity provide the individual?s request for amendment and the denial with any future disclosures of the PHI that is the subject of the amendment; and 4) a description of how the individual may complain to the covered entity and to OCR, including the name, or title, and telephone number of the contact person or of?ce designated by the covered entity to be responsible to receive Privacy Rule complaints. 45 C.F.R. 164.526 The covered entity may reasonably limit the length of a statement of disagreement. The covered entity may prepare a written rebuttal to the individual's statement of disagreement. Whenever such a rebuttal is prepared, the covered entity must provide a copy to the individual who submitted the statement of disagreement. 45 C.F.R. 164.526 The Privacy Rule also sets forth provisions related to recordkeeping and identi?cation of the record or PHI that is the subject of the diaputed amendment (45 C.F.R. and relating to future disclosures of the statement of disagreeth (45 C.F.R. 164.526 Pursuant to 45 C.F.R. 164.502 a covered entity must treat an individual?s personal representative as the individual for purposes of the Privacy Rule. That is, an individual?s personal representative has the right to have a. covered entity amend PHI or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. 0 For adults or emancipated minors, a personal representative is a person who has the authority to make decisions related to health care for the adult or emancipated minor. 45 C.F.R. 164.502 For unemancipated minors, a personal representative is a parent, guardian, or other person acting in loco parentis who has the authority to make decisions related to health care for the unemancipated minor. 45 C.F.R. 164.502 - For deceased individuals, a personal representative is an executor, administrator, or other person who has the authority to act on behalf of the deceased individual or the deceased individual?s estate. 45 C.F.R. 164.502 gyms, DEPARTMENT OF HEALTH a HUMAN SERVICES one 0' "163va a' i; voice - {214} rat-toss. (soc) aes1 019 Of?ce for Civil Rights, Region vr TDD 421417676940. taco} ear-rear 1301 Young Street. Suite 1169 Fax - {214) 757-0432 Dallas. TX 752th seasons Ms. Andrea Wilson, RHIA, CIPP, Privacy Implementation Coordinator Information Access 3c Privacy Dept of Veteran's Affairs-Veterans Health Admin 310 Vermont Avenue, NW Washington, DC 20420 - Our Transaction Number: 13-150374 Dear Privacy Of?cer: On October 23, 2.012, the US. Department of Health and Human Services (HI-IS), Of?ce for Civil Rights (OCR), received a complaint alleging that El Paso VA Health Care System, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, I, the complainant, alleges that he requested the covered entity to an amendment to his medical records removing the ?ag for ?drug seeking behavior", but has not received a response. This allegation could re?ect a violation of 45 CPR. 164.526. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. The complaint received by OCR alleges that the covered entity failed to comply with the complainant?s request for an amendment of medical records. The Privacy Rule states that an individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. 45 CPR. 164.526 The covered entity must act on the individual?s request for an amendment no later than 60 days after receipt of such a request. 45 C.F.R.. 164.3126 If the covered entity denies the requested amendment, in whole or in part, the covered entity must provide the individual with a timely, written denial. 45 C.F.R. 164.526 Pursuant to its authority under 45 C.F.R. 160.304(a) and OCR has determined to resolve this matter informally through the provision of technical assistance El Paso VA Health Care System. To that end, OCR has enclosed material explaining the Privacy Rule provisions related to Amendment of Protected Health Information. You are encouraged to review these materials closely and to share them with your staff as part of the Health Insurance Portability and Accountability Act (HLPAA) training you provide to your workforce. You are also encouraged to assess and determine whether there may have been any noncompliance as alleged by the complainant in this matter, and, if so, to take the steps necessary to ensure such noncompliance does not occur in the future. In addition, OCR encourages you to review the facts of this individual request for amendment and provide the individual the appropriate written response swiftly if the request meets the requirements of the Privacy Rule. Should OCR receive a similar allegation of noncompliance against El Paso VA Health Care Systemin the future, OCR may initiate a formal investigation of that matter. In addition, please note that, after a period of six months has passed, OCR may initiate and conduct a compliance review of El Paso VA Health Care System related to El Paso VA Health Care System?s compliance with the Amendment provisions of the Privacy Rule. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have any questions regarding this matter, please contact Debbie Campos, Investigator, at (214) 767-3595 (Voice) or (214) 767-8940, (800) 537-7697 (T DD). Sincerely, LE3). [.02 w@ ERegional Man Enclosure: Amendment of Protected Health Information Amendment of Protected Health Information The Privacy Rule states that an individual has the right to have a covered entity amend protected health information (PI-II) or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. 45 C.F.R. 164.526 The covered entity must permit an individual to request that the covered entity amend the PHI maintained in the designated record set, and the covered entity may require individuals to make requests for amendment in writing and to provide a reason to support a requested amendment, provided that it informs individuals in advance of such requirements. 45 C.F.R. 164.526 The covered entity must act on the individual?s request for an amendment no later than 60 days after receipt of such a request. 45 C.F.R. 164.526 If the covered entity is unable to act upon the request within this time period, it may extend the time for such action by no more than 30 days, provided that the covered entity, no later than 60 days after receipt of the request, provides the individual with the reason(s) for the delay in writing and the date by which it will complete its action on the request. The covered entity may have only one such extension of time on a request for an amendment. The covered entity may respond to an individual?s request for an amendment by either accepting or denying the requested amendment. If the covered entity grants the requested amendment, in whole or in part, the covered entity must make the amendment to the affected records, in the marmer prescribed at 45 C.F.R. inform the individual, in the manner prescribed at 45 C.F.R. and make reasonable efforts to inform certain other individuals of the amendment, in the manner prescribed at 45 C.F.R. The covered entity may deny the request for an amendment if it determines that the PHI or record that is the subject of the request is not part of the designated record set; would not be available for inSpection under 45 C.F.R. 164.524 (access of individuals to protected health information); is accurate and complete; or was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment. 45 .F.R. If the covered entity denies the requested amendment, in whole or in part, it must provide the individual with a timely, written denial. The denial must be in plain language and contain: 1) the basis for the denial; 2) the individual?s right to submit a written statement disagreeing with the denial and how the individual may ?le such a statement; 3) a statement that, if the individual does not submit a statement of disagreement, the individual may request that the covered entity provide the individual?s request for amendment and the denial with any ?iture disclosures of the PHI that is the subject of the amendment; and 4) a description of how the individual may complain to the covered entity and to OCR, including the name, or title, and telephone number of the contact person or of?ce designated by the covered entity to be responsible to receive Privacy Rule complaints. 45 C.F.R. 164.526 The covered entity may reasonably limit the length of a statement of disagreement. The covered entity may prepare a written rebuttal to the individual's statement of disagreement. Whenever such a rebuttal is prepared, the covered entity must provide a copy to the individual who submitted the statement of disagreement. 45 C.F.R. 164.526 The Privacy Rule also sets forth provisions related to recordkeeping and identi?cation of the record or PHI that is the subject of the disputed amendment (45 C.F.R. and relating to ?iture disclosures of the statement of disagreement (45 C.F.R. 164.526