C.W. Bill Young VA Medical Center

Issue: Veteran A reported to the Release of Information unit and explained he received copies of his medical records and attached was a fax pertaining to Veteran B. The fax was a medical records request, which included Veteran B's full name,…

Outcome: 02/09/15: The Incident Resolution Service Team has determined that Veteran B will be sent a letter offering credit protection services.…

Issue: A VA employee inadvertently sent an unencrypted email message containing one Veteran's full name, full Social Security Number, date of admission and date of discharge to her personal email account verses government email address. The employee discovered ten minutes after…

Outcome: 02/06/15: The Incident Resolution Service Team has determined that there was a policy violation. No data breach has occurred.…

Issue: Employee/Veteran requested a copy of his/her Sensitive Patient Access Report (SPAR). Upon review, the Employee/Veteran was unable to identify why another employee accessed the record. This concern was presented to the Privacy Officer (PO).…

Outcome: 02/23/15: The Incident Resolution Service Team has determined that Veteran A will be sent a notification letter.…

Issue: Veteran A contacted his healthcare provider to follow up on an upcoming appointment. The provider could not confirm and during the conversation it was determined that Veteran A received a copy of Veteran B's appointment list. Veteran A acknowledged the…

Outcome: 01/23/15: The Incident Resolution Service Team has determined that Veteran B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: Employee A and Employee B told Employee/Veteran C that he overheard his doctor talking about his protected health information (PHI) in the lobby area outside the canteen with a nurse.

Outcome: PO updates -- The fact findings provided by Service Mgt indicate the provider discussed the Veteran/employee's treatment while having lunch in the canteen with a nurse. The Vetern/employee's co-worker overheard the dicussion. The nurse did not have a need to…

Issue: Veteran/employee reports that he was brought to the VA after a suicide attempt for treatment on 1/3/15. On 1/4/15, a VA employee called his co-worker and asked if the co-worker knew about it and disclosed information about the event. The…

Outcome: 01/23/15: The ISO provided the PO with a SPAR. The PO requested the assistance of Service Mgt to determine if questionable accesses were in the function of assigned job duties. Service Mgt was able to confirm all but for 5…

Issue: The Information Security Officer (ISO) discovered patient identification labels containing Veteran A's full name and full social security number left behind on a wheel chair on VA grounds. ISO retrieved the labels and turned them over to the Privacy Officer…

Outcome: 12/15/14: The Incident Resolution Service Team has determined that Veteran A will be sent a letter offering credit protection services.…

Issue: Veteran A received a copy of a non-VA care coordination cover letter addressed to Veteran A, however the attachment was an approval of outpatient services for Veteran B. The approval included Veteran B's full name, last four digits of the…

Outcome: 12/04/14: The Incident Resolution Service Team has determined that Veteran B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: Veteran A requested his medical records through Release of Information (ROI). There are two Veterans with the same last name and similar first names. Veteran B was selected by the ROI clerk. Veteran B's information was entered into the 10-5345,…

Outcome: 11/19/14: The Incident Resolution Service Team has determined that Veteran B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: Employee A requested a Sensitive Patient Access Report (SPAR) from the Privacy Officer (PO). Upon review of the report, Employee A determined that one or more other employees accessed the record inappropriately.…

Outcome: 11/26/14: The Incident Resolution Service Team has determined that Employee A will be sent a notification letter. The PO has determined that at least one employee accessed the employee's record inappropriately.…