as ml. ?feet, .2 DEPARTMENT 8: HUMAN SERVICES Voice - {214) ?67-4056, TDD - {214} (FM) - (214} OFFICE OF THE SECRETARY Office for Civil Rights, Region VI 1301 Young Street. Suite 1169 75202 July 7, 2014 Re: Edward Hartnett vs. Michael E. DeBakey VA Medical Center Transaction number: 06-14-135887 {bli?lthi?FHC) On July 1, 2014, the US. Deparunent of Health and Human Services (HHS), Of?ce for Civil Rights (OCR), received your complaint alleging that the Michael E. DeBakey VA Medical Center, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health information (45 Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, you allege that you discovered falsi?ed information in your medical record regarding your May 7, 2014 medical appointment with {bliiliblilli?il This allegation could re?ect a violation of 45 OER. 164.526. Thank you for bringing this matter to attention. Your complaint is an integral part of enforcement efforts. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. The Privacy Rule states that an individual has the right to have a covered entity amend protected health information (PHI) or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. 45 C.F.R. 164.526 The covered entity must act on the individual?s request for an amendment no later than 60 days after receipt of such a request. If the covered entity denies the requested amendment, in whole or in part, the covered entity must provide the individual with a timely, written denial. We have carefully reviewed your complaint against the Michael E, DeBakey VA Medical Center and have detennined to resolve this matter informally through the provision of technical assistance to the Michael E, DeBakey VA Medical Center. Should OCR receive a similar allegation of noncompliance against the Michael E. DeBakey VA Medical Center in the future, OCR may initiate a formal investigation of that matter. For your informational purposes, OCR has enclosed material regarding the Privacy Rule provisions related to your right to amend your medical records. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have questions regarding this matter, please write us or contact Myra Fain at (214) 76?? 3923 (Voice), (214) 767-8940 (TDD), or by e-mail at Myra.Fain@hhs.gov. Please be advised that conununication by e~mail presents a risk of disclosure of the transmitted information to, or interception by, unintended third parties. Please keep this in mind when communicating with us by e-mail. When contacting this of?ce, please remember to include the reference number that we have given this ?le (08-74149). Enclosure: Amendment of Protected Health Information Amendment of Protected Health Information The Privacy Rule states that an individual has the right to have a covered entity amend protected health information (PHI) or a record about the individual in a designated record set for as long as the Pi-lI is maintained in the designated record set. 45 C.F.R. 164.526 The covered entity must permit an individual to request that the covered entity amend the PHI maintained in the designated record set, and the covered entity may require individuals to make requests for amendment in writing and to provide a reason to support a requested amendment, provided that it informs individuals in advance of such requirements. 45 C.F.R. 164.526 The covered entity must act on the individual's request for an amendment no later than 60 days after receipt of such a request. 45 C.F.R. 164.526 If the covered entity is unable to act upon the request within this time period, it may extend the time for such action by no more than 30 days, provided that the covered entity, no later than 60 days after receipt of the request, provides the individual with the reason(s) for the delay in writing and the date by which it will complete its action on the request. The covered entity may have only one such extension of time on a request for an amendment. The covered entity may respond to an individual's request for an amendment by either accepting or denying the requested amendment. If the covered entity grants the requested amendment, in whole or in part, the covered entity must make the amendment to the affected records, in the manner prescribed at 45 C.F.R. inform the individual, in the manner prescribed at 45 C.F.R. and make reasonable efforts to inform certain other individuals of the amendment, in the manner prescribed at 45 C.F.R. The covered entity may deny the request for an amendment if it determines that the PHI or record that is the subject of the request is not part of the designated record set; would not be available for inspection under 45 C.F.R. 164.524 (access of individuals to protected health information); is accurate and complete; or was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment. 45 C.F.R. If the covered entity denies the requested amendment, in whole or in part, it must provide the individual with a timely, written denial. The denial must be in plain language and contain: 1) the basis for the denial; 2) the individual?s right to submit a written statement disagreeing with the denial and how the individual may ?le such a statement; 3) a statement that, if the individual does not submit a statement of disagreement, the individual may request that the covered entity provide the individual's request for amendment and the denial with any future disclosures of the PHI that is the subject of the amendment; and 4) a description of how the individual may complain to the covered entity and to OCR, including the name, or title, and telephone number of the contact person or of?ce designated by the covered entity to be responsible to receive Privacy Rule complaints. 45 C.F.R. 164.526 The covered entity may reasonably limit the length of a statement of disagreement. The covered entity may prepare a written rebuttal to the individual's statement of disagreement. Whenever such a rebuttal is prepared, the covered entity must provide a copy to the individual who submitted the statement of disagreement. 45 C.F.R. 164.526 The Privacy Rule also sets forth provisions related to recordkeeping and Identification of the record or PHI that is the subject of the disputed amendment (45 C.F.R. and relating to future disclosures of the statement of disagreement (45 C.F.R. 164.526 Pursuant to 45 C.F.R. 164.502 a covered entity must treat an individual?s personal representative as the individual for purposes of the Privacy Rule. That is, an individuai's personal representative has the right to have a covered entity amend PHI or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. a- For adults or emancipated minors, a personal representative is a person who has the authority to make decisions related to health care for the adult or emancipated minor. 45 C.F.R. 164.502 - For unemancipated minors, a personal representative is a parent, guardian, or other person acting in ioco parentis who has the authority to make decisions related to health care for the unemancipated minor. 45 C.F.R. 164.502 For deceased individuais, a personal representative is an executor, administrator, or other person who has the authority to act on behalf of the deceased individual or the deceased individual?s estate. 45 C.F.R. 164.502 v4, DEPARTMENT OF HEALTH 3: HUMAN SERVICES voice - (214i rev-4056. TDD - {214} rev?3940. (FAX) - {214) 767-0432 mm:lev.hhs.goqugd OFFICE OF THE SECRETARY Office for Civil Rights. Region VI 1301 Young Street, Suite 1169 Dallas, TX 75292 July 7, 2014 Privacy Of?cer Michael E. DeBakey Medical Center 2002 Holcombe Blvd. Houston, TX 77030 Re: s. Michael E. DeBakey VA Medical Center Transaction number: 06?14-1 85837 Dear Privacy Of?cer: On July 1, 2014, the US. Department of Health and Human Services (HHS), Of?ce for Civil Rights (OCR), received a complaint alleging that Michael DeBakey VA Medical Center, the covered entity, has violated the Federal Standards for Privacy of Individually Identi?able Health Information andfor the Security Standards for the Protection of Electronic Protected Health Information (45 C.F.R. Parts 160 and 164, Subparts A, C, and E, the Privacy and Security Rules). Speci?cally, {bliilibliilim the complainant, alleges that he discovered falsi?ed information in his medical record regarding his May 7, 2014 medical appointment with This allegation could re?ect a vioiation of 45 CPR. 164.526. OCR enforces the Privacy, Security, and Breach Noti?cation Rules, and also Federal civil rights laws which prohibit discrimination in the delivery of health and human services because of race, color, national origin, disability, age, and under certain circumstances, sex and religion. The complaint received by OCR alleges that the covered entity failed to comply with the complainant?s request for an amendment of medical records. The Privacy Rule states that an individual has the right to have a covered entity amend protected health information (PHI) or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. 45 C.F.R. 164.526 The covered entity must act on the individual?s request for an amendment no later than days after receipt of such a request 45 C.F.R. 164.526 If the covered entity denies the requested amendment, in whole or in part, the covered entity must provide the individual with a timely, written denial. 45 C.F.R. 164.526 Pursuant to its authority under '45 CPR. 160.304(a) and OCR has determined to resolve this matter informally through the provision of technical assistance to Michael E. DeBakey VA Medical Center. To that end, OCR has enclosed material explaining the Privacy Rule provisions related to Amendment of Protected Health Information. You are encouraged to review these materials closely and to share them with your staff as part of the Health Insurance Portability and Accountability Act training you provide to your workforce. You are also encouraged to assess and determine whether there may have been any noncompliance as alleged by the complainant in this matter, and, if so, to take the steps necessary to ensure such noncompliance does not occur in the future. In addition, OCR encourages you to review the facts of this individual request for amendment and provide the individual the appropriate written response swiftly if the request meets the requirements of the Privacy Rule. Should OCR receive a similar allegation of noncompliance against Michael E. DeBakey VA Medical Center in the future, OCR may initiate a fennel investigation of that matter. In addition, please note that, after a period of six months has passed, OCR may initiate and conduct a compliance review of Michael E. DeBakey VA Medical Center related to Michael E. DeBakey VA Medical Center?s compliance with the Amendment provisions of the Privacy Rule. Based on the foregoing, OCR is closing this case without further action, effective the date of this letter. determination as stated in this letter applies only to the allegations in this complaint that were reviewed by OCR. Under the Freedom of Information Act, we may be required to release this letter and other information about this case upon request by the public. In the event OCR receives such a request, we will make every effort, as permitted by law, to protect information that identi?es individuals or that, if released, could constitute a clearly unwarranted invasion of personal privacy. If you have questions regarding this matter, please write us or contact Myra Fain at (214) 767- 3928 (Voice), (214) 7'67-3940 (TDD), or by e-mail at Myra.Fain@hhs.gov. Please be advised that communication by e?mail presents a risk of disclosure of the transmitted information to, or interception by, unintended third parties. Please keep this in nrind when communicating with us by e-mail. When contacting this of?ce, please remember to include the reference number that we have given this ?le (08-74149). Sine orge A. 0 Regional Manager Enclosure: Amendment of Protected Health Information Amendment of Protected Health Information The Privacy Rule states that an individual has the right to have a covered entity amend protected health information (PI-ll) or a record about the individual in a designated record set for as long as the PHI is maintained in the designated record set. 45 C.F.R. 164.526 The covered entity must permit an individual to request that the covered entity amend the PHI maintained in the designated record set, and the covered entity may require individuals to make requests for amendment in writing and to provide a reason to support a requested amendment, provided that it informs individuals in advance of such requirements. 45 C.F.R. 164.526 The covered entity must act on the individual?s request for an amendment no later than 60 days after receipt of such a request. 45 C.F.R. 164.526 If the covered entity is unable to act upon the request within this time period, it may extend the time for such action by no more than 30 days, provided that the covered entity, no later than 60 days after receipt of the request, provides the individual with the reason(s) for the delay in writing and the date by which it will complete its action on the request. The covered entity may have only one such extension of time on a request for an amendment. The covered entity may respond to an individual?s request for an amendment by either accepting or denying the requested amendment. If the covered entity grants the requested amendment, in whole or in part, the covered entity must make the amendment to the affected records, in the manner prescribed at 45 C.F.R. inform the individual, in the manner prescribed at 45 C.F.R. and make reasonable efforts to inform certain other individuals of the amendment, in the manner prescribed at 45 C.F.R. The covered entity may deny the request for an amendment if it determines that the PHI or record that is the subject of the request is not part of the designated record set; would not be available for inspection under 45 C.F.R. 164.524 (access of individuals to protected health information); is accurate and complete; or was not created by the covered entity, unless the individual provides a reasonable basis to believe that the originator of the PHI is no longer available to act on the requested amendment. 45 C.F.R. If the covered entity denies the requested amendment, in whole or in part, it must provide the individual with a timely, written denial. The denial must be in plain language and contain: 1) the basis for the denial; 2) the individual's right to submit a written statement disagreeing with the denial and how the individual may ?le such a statement; 3) a statement that, if the individual does not submit a statement of disagreement, the individual may request that the covered entity provide the individual?s request for amendment and the denial with any future disclosures of the PHI that is the subject of the amendment; and 4) a description of how the individual may complain to the covered entity and to OCR, including the name, or title, and telephone number of the contact person or of?ce designated by the covered entity to be responsible to receive Privacy Rule complaints. 45 C.F.R. 164.526 The covered entity may reasonably limit the length of a statement of disagreement. The covered entity may prepare a written rebuttal to the individual's statement of disagreement. Whenever such a rebuttal is prepared, the covered entity must provide a copy to the individual who submitted the state1nent of disagreement. 45 C.F.R. 164.526 The Privacy Rule also sets forth provisions related to recordkeeping and identi?cation of the record or PHI that is the subject of the disputed amendment (45 C.F.R. and relating to future disclosures of the statement of disagreement (45 C.F.R. 164.526