in?ow

4'

 

m?m.

DEPARTMENT OF HEALTH 3: HUMAN SERVICES OFFICE OF THE SECRETARY

voice - (214) rev-eons. taco) see-101s Too - (214} res-3940

(FAX) - (214) Tar-c432  Of?ce for Civil Rights, Region VI
?hi-rm 130] Young Street, Suite ?69

Dallas, TX $5202



 



 

 

 

Ms. Andrea Wilson. RHIA, CIPP, CIPPIG

VHA Privacy Implementation Coordinator

Information Access and Privacy Of?ce IOPECI

Department of Veterans Affairs-Veterans Health Administration
810 Vermont Ave, NW

Washington, DC 20420

Our Reference number: 13-161209
Dear (Miami?inc] and Ms. Wilson:

On June 6, 2013, the US. Department of Health and Human Services Of?ce for Civil
Rights (OCR) received a complaint alleging a violation of the Federal Standards for Privacy of
Individually Identi?able Health Information andfor the Security Standards for the Protection of
Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the
Privacy and Security Rules). Speci?cally, libi'iBi'ibi'Eii'ECi  alleges that Iii-?333315303033 
a workforce member at the Emest Childers VA Outpatient Clinic, (VA) impermissiny used
(accessed) her medical record. This allegation could re?ect violations of45 CIR ?164.502,
uses and disclosures of protected health information, (PHI).

OCR enforces the Privacy and Security Rules, and the Breach Noti?cation Rule. OCR also
enforces Federal civil rights laws which prohibit discrimination in the delivery of health and
human services because of race, color, national origin, disability, age, and under certain
circumstances, sex and religion.

   

 

We have reviewed the matters raised in the complaint. On Setember 27, 2013, OCR contacted
?onal information. According to on May 1, 2013, she became

I 5.

aware that had accessed her electronic medical record and requested a report.
This - ort contained the identity of all those individuals who accessed her electronic record.
{bii?ilibliil'ici' made a Privacy complaint with the facility?s Privacy of?cial and it continued that
id access her electronic medical record. provided OCR documentation
of the ?Sensitive Patient Access Report? that indicated that on Jul 6 20 2 had
accessed electronic medical record. In addition, {bi-Bimini? provided OCR
documentation of the breach noti?cation letter she had received from the VA.

 
 
 

 

   
    
   

 
   

    

 

 

Page 2 onImW'm?m land Ms. Andrea Wilson

On January 27, 2014, OCR contacted Ms. Wilson, VHA Privacy Coordinator for the Department
of Veterans Affairs Health Administration, regarding the allegation as stated in the complaint.
The VA acknowleded the above allegation, According to the VA, the facility's Privacy of?cer
received request for a copy of the Sensitive Patient Access Report, (SPAR) and
after reviewing the report, made a HIPAA complaint. It was determined that who is a
Registered Nurse (RN) had no legitimate need to have accessed {bli?libl'iilicl :electronic medical
record. However, at the time that RN accessed electronic medical record,
she was providing training to ince he was a new employee, and in trying to pull up
his record, she accidently pulled up electronic madical record. The VA stated that
should have used a ?test patient? for training purposes but she failed to do that. As a
result, RN received disciplinary action and she was required to complete ?Rules of
Behavior? training. In addition, I eceived a Breach Noti?cation Letter containing an
apology and on obtaining her credit report. A review of the VHS Privacy policies
does appear to indicate compliance with the Privacy Rule.

 

All matters raised by this complaint at the time it was ?led have now been resolved through the
voluntary compliance actions of the VA. Therefore, OCR is closing this case.

determination as stated in this letter applies only to the allegations in this complaint that
were reviewed by OCR.

Under the Freedom of Information Act, we may be required to release this letter and other
information about this case upon request by the public. In the event OCR receives such a request,
we will make every effort, as permitted by law, to protect information that identi?es individuals
or that, if released, could constitute a clearly unwarranted invasion of personal privacy.

If you have any questions, please contact Marcie Stanley, Investigator, at (214) 767- 03 T4
(Voice), (214) 767- 8940 (TDD).

Sincerely,

go A. Lo
Regional VI