C.W. Bill Young VA Medical Center

Issue: A Veteran's health information including 7332 data was released without Veteran authorization.

Outcome: 09/08/14: The Incident Resolution Service Team has determined that Veteran A will be sent a 7332 notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: Veteran states he requested a CD of medical records to be sent to his P.O. Box, but ROI sent it to an unauthorized address.

Outcome: 09/09/14: PO update -- It was confirmed that the Veteran signed an authorization on December 24, 2014 for a CD of his medical records to be sent to a P. O. Box, but instead they were sent to his old…

Issue: Veteran A reported to the Privacy Officer that they received copies of their non-VA records from the Release of Information unit, upon review of the records Veteran A discovered information pertaining to Veterans B and C.

Outcome: 09/02/14: The Incident Resolution Service Team has determined that Veterans B and C will be sent HIPAA notification letters due to Protected Health Information (PHI) being disclosed.…

Issue: During an internal audit, the ROI lead discovered Veteran A's IIHI was released to the Social Security Administration in response to a request on May 9, 2014; however, the request did not contain Veteran A's signed authorization.

Outcome: 08/29/14: The Incident Resolution Service Team has determined that there was a policy violation. While there was an unauthorized access/disclosure of data, it has been determined that the incident has a low probability of a risk of compromise.…

Issue: Veteran A received two CDs in the mail from the Release of Information Office. The 1st CD contained Veteran A's medical records. The 2nd CD contained Veteran B's radiology images.

Outcome: 08/19/14: The Incident Resolution Service Team has determined that Veteran B will be sent a letter offering credit protection services.…

Issue: Veteran A visited the Lee County Healthcare Center for an appointment. The examiner began asking questions unrelated to the Veteran. It was determined that Veteran B's health information was entered in Veteran A's electronic health record…

Outcome: 08/15/14: The Incident Resolution Service Team has determined that there was a policy violation. While there was an unauthorized access/disclosure of data, it has been determined that the incident has a low probability of a risk of compromise, as Veteran…

Issue: Veteran A reported to the Privacy Office that they received Veteran B's medical documentation in the mail. Veteran B's instruction sheet for upcoming procedure was mailed to Veteran A along with their own instructions. Veteran A reported that they would…

Outcome: 08/14/14: The Incident Resolution Service Team has determined that Veteran A and B will be sent a notification letter.…

Issue: Employee/Veteran reports to Privacy Officer (PO) after reviewing a Sensitive Patient Access Report (SPAR), that more than one employee had accessed their record without authority or a need to know.

Outcome: 08/13/14: The Privacy Officer has determined at least one unauthorized entry to the Employees record. PO is escalating this ticket from a complaint to an incident. The Incident Resolution Service team determined that the Employee/Veteran will receive a HIPAA letter…

Issue: Patient A called to report that he received Patient B's radiology report.

Outcome: 08/06/14: The Incident Resolution Service Team has determined that Patient B will be sent a letter offering credit protection services.…

Issue: A VA employee reported to the Privacy Officer (PO) that Veteran A's health information was mis-faxed to an assisted living facility.

Outcome: 07/11/14: The Incident Resolution Service Team has determined that Veteran A will be sent a letter offering credit protection services.…