DEPA TH MAN SERVICES THE CRETARY Voice - {214] {300) 3613-1019 TDD - (214) (PM) - (214} 757-0432 Office for Civil Rig Region 1301 Young Street, units 1169 Dallas, TX T5202 Ms. Andrea Wilson, RHIA, CIPP, VHA Privacy Implementation Coordinator Information Access and Privacy O?ice- IDPECI i Department of 1Veterans Ariana-Veterans Health Administration 310 Vermont Ave, NW Washington DC 20420 OCR Transaction No: 13454022 Deer (biiei?ibimici Ms. 1Wilson: On January 7, 2013, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR) received a complaint alleging that Veterans Health Care System of the Ozarks (VHCS of the Ozarks), the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Infomation andfor the Security Standards for the Prote tion of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Suhparts A, C, an E, the Privacy and Security Rules). Speci?cally, Emmi-(mimic: I (complainant) allege while sittin in a Merit System Board Hearing from November 12-14, 2012 with her semi approximately 65 patients? protected health information (PHI) were of losed anthout the patients? knowledge. The complainant further alleges that she brought thi to the attention of the director, Ibut did not receive a response. This allegation could re?ect violations of 45 C.F.R. 164.502(a) Uses and disclosures, 164.530(c) Safeguards, and 1) Complaints to the covered entity. - OCR enforces the Privacy and Security Rules, and the Breach Noti?cation Rule. 0(i[R also enforces Federal civil rights laws that prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and, under certain circumstances. sex, and religion. On July 10, 2013, OCR notified Ms. Andrea Wilson, Veterans Health Administration i?rivacy Implementation Coordinator, of the complaint. Ir On August 13, 2013, OCR received a response from Veterans Health Administration (VHA) which included copies to support their ?ndings. in their investigation, VHCS of the Ozarks determined that a workforce member released 65 patients? information without redacting information. VHCS of the Ozarks maintains that due to the volume of documentation they had been required to provide, in reference to the numerous cases that have been initiate I by the Page 2 of 2 (13-15-4022) complainant, it was extremely dif?cult to determine when the patient information was - vided. Additionally, VHCS of the Ozarks maintains that it is their belief that prior to {bltalibltiltcl termination, he took pictures or saved images on his devices of patients? information. CS of the Ozarks provided a written statement of a workforce member that witnessed this actionill During the investigation of this complaint and upon receipt of an apology letter from the overed entity dated May 22, 2014, the complainant provided OCR with an additional document at the covered entity that included another patient?s information. WICS of the Ozarks rcvie ed the document, but could not determine exactly when it was provided or if they did provide it OCR emailed the complainant on June 24, 2014, to determine when the complainant received the document. in a reply on June 24, 2014, the complainant stated that the last communicatidns that she received was in November 2013, but she has not provided OCR with a de?nitive date. In an e?'ort to take corrective action, VHCS of the Ozarks sanctioned the workforce mem that inappropriately provided patients? information to the complainant. VHCS of the Ozar also sent the complainant a letter apologizing for the incident dated May 22, 2014. I As part of our investigation, OCR reviewed the VHCS of the Ozarks?s policies speci?c 'to this complaint and found them to be in compliance with the Privacy Rule. All matters raised by this complaint at the time it was ?led have now been resolved tlro?ifh the voluntary compliance actions of VHCS of the Ozarks; therefore, OCR is closing thi case. OCR's determination as stated in this letter applies only to the allegations in this compl tthat were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives uch a request, we will make every effort, as permitted by law, to protect information that id titles individuals or that, if released, could constitute a clearly unwarranted invasion of I nal privacy. If you have any questions, please contact Debbie Campos, Investigator, at (214) 767?1837 (Voice), (214) 767-3940 (TDD), or E-mail to: Debbie.Carn s. ov. Sincerely,