Clement J. Zablocki Veterans Affairs Medical Center

Issue: An email regarding an employee's worker's comp claim (containing Protected Health Information (PHI) was accidentally sent to the incorrect VA employee in the Global Address List (GAL). The email was also sent unencrypted.

Outcome: 10/29/14: The Incident Resolution Service Team has determined that there was a policy violation. While there was an unauthorized access/disclosure of data, it has been determined that the incident has a low probability of a risk of compromise.…

Issue: Three ID stickers with full names and full SSNs were found in the parking lot, and handed over to Nurse Supervisor. Stickers were for EKG and a UA.

Outcome: 10/27/14: The Incident Resolution Service Team has determined that one Veteran will be sent letters offering credit protection services.…

Issue: The Privacy Officer (PO) was alerted by a Pharmacy employee at the facility that Patient A was given Patient B's medication by mistake at Pharmacy window. The PO will follow up to determine if the medication has been returned for…

Outcome: 10/27/14: The Incident Resolution Service Team has determined that Patient B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: Patient has notified VA that appointment information was shared with Patient's wife. Wife is not shown to be involved closely with Patient's care. Care teams have been otherwise alerted to not discuss info with Wife, as she is now specified…

Outcome: 10/22/14: The Incident Resolution Service Team has determined that one Patient will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: Patient A received Patient B's medication from the Pharmacy by mistake. Facility was alerted when contacting one of the two patients for unknown purpose. Patient A allegedly lost medication on bus (as reported when questioned), so information is unrecoverable. The…

Outcome: 10/22/14: The Privacy Officer knows who Patient A and Patient B are. The Incident Resolution Service Team has determined that Veteran B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: A note with protected health information (PHI) was found in an exit hallway. The time on the note shows "3:50 PM," and was probably only in the area for about 45 minutes before retrieval. It contained one Veteran's name, partial…

Outcome: 10/15/14: The Incident Resolution Service Team has determined that one Veteran will be sent a HIPAA notification letter due to Protected Health Information (PHI) being exposed.…

Issue: Allegations from Employee in Service that another specified Employee is reading Veteran health records without a business purpose. Will review sensitive accesses to determine if there are business processes associated with them, and then work with management if there were…

Outcome: 10/17/14: The Privacy Officer (PO) determined that one of the two employees accused of inappropriate access has no defense for a series of accesses. 10/27/14: The Incident Resolution Service Team determined that the employee whose record was accessed will receive…

Issue: Patient A received Patient A's and Patient B's eyeglasses on Friday, September 26. Eyeglasses were accompanied by Patient A's address and name. Information has not yet been returned to facility.

Outcome: 09/30/14: The Incident Resolution Service Team has determined that Veteran B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: A Provider worksheet was found by an Employee on a shelf in the Canteen Retail Center. It is unknown at this time as to length of time that worksheet was exposed to public. Six Veterans names and protected health information…

Outcome: 09/12/14: The sheet was on the Clearance shelf in the Retail Center for less than two hours. It was lying open, not closed along the folds, in the shelving of the Clearance items. After identifying three of the Veterans by…

Issue: Two patients' authorizations for Non-VA Care were placed in each others envelopes and sent out via mail. It was confirmed that one was returned back to us via patient returning it to clinic on 09/10/14. After researching the other patient's…

Outcome: 09/11/14: Patient B just called and said she did not receive anyone else's authorization, but was awaiting hers. She'll call if she does receive it later, and USPS was just slow, but they would have been sent on 09/05/14. The…