Michael E. DeBakey VA Medical Center

Issue: The Research Compliance Officer (RCO) reports that during a routine audit of HIPAA authorizations for a research study she discovered that five authorizations were missing. After a search, the Principal Investigator (PI) has not been able to find the authorizations.…

Outcome: 05/09/14: The five Veterans will be sent HIPAA notifications, as their PHI was potentially disclosed.…

Issue: Employee received copy of sensitive patient access report and is questioning whether one MEDVA employee's access to his record was for a valid business purpose.

Outcome: 05/13/14: The Incident Resolution Team has determined that the employee will be sent a HIPAA notification letter due to Protected Health Information (PHI) being accessed inappropriately. This is not HITECH reportable as it happened before 9/23/09.…

Issue: OIG Hotline Case Referral notified the Houston Medical Center that they received a complaint from a former contract employee that she received an email from a Houston Medical Center employee that had appointment information for another individual attached. The appointment…

Outcome: 03/31/14: The Incident Resolution Team has determined that Veteran A will be sent a letter offering credit protection services.…

Issue: A VA Physician gave a written prescription to Veteran A. The prescription contained Veteran B's full name and last four digits of the SSN and prescription name.…

Outcome: 03/04/14: The Incident Resolution Team (IRT) determined that Veteran B will receive a HIPAA letter of notification, since his protected health information (PHI) was disclosed.…

Issue: Veteran/employee requested copy of SPAR report and questioned another VA employee's access to her medical record. The employee accessed her medical record on 22 occasions since 2008.…

Outcome: 03/07/14: It is not known what information the employee accessed or why they accessed it. The employee will be sent a letter offering credit protection services.…

Issue: A Veteran's wife called the Chief of Fee Basis and informed him in September or early October she had received another Veteran's "Request For Outpatient Services Form." She said she had tried to contact someone at the VA on several…

Outcome: 01/17/14: The Privacy Officer believes that both Veterans had their information disclosed improperly. Both will be offered credit protection services.…

Issue: RN reported that she was on her way to deliver medications to Veterans, stopped for gas, and when she arrived at her destination discovered the bag of medications was missing from her front seat. She does not know if the…

Outcome: 01/16/14: Both Veteran will receive a HIPAA letter of notification.…

Issue: Upon discharge from the hospital a Veteran asked the nurse what he was supposed to do with two Ziploc bags. Upon inspection one bag had the Veteran's medications and the other bag had medications that were for another Veteran. The…

Outcome: 01/13/14: Veteran B will be sent a notification letter.…

Issue: Social Worker (SW)was en route to Veterans Court Docket (walking to vehicle at the MEDVAMC) while carrying a folder with the future appointment lists for the ~56 veterans enrolled in the court. SW regularly distributes the appointment lists to the…

Outcome: 01/10/14: The one Veteran whose information was potentially lost will be offered credit protection services.…

Issue: MEDVA Social Worker notified VA Police dispatcher that her VA issued laptop and personally owned briefcase were stolen from the front seat of her vehicle. The laptop was encrypted. The briefcase is believed to have contained approximately 200 Veterans' patient…

Outcome: 12/31/13: Per the PO, the laptop was left on the front seat of the employee's car in her personal briefcase. The following was in the briefcase. A spreadsheet that contained Veterans' last name, first name, telephone number, and some had…