VA Health Care Upstate New York (VISN 2)

Issue: A Specialty Clinic Nurse Manager reported that a Program Support Assistant (PSA) in her department had accessed medical records of two (2) patients outside her need to know to do her job, thus resulting in a privacy violation. The PSA…

Outcome: The Nurse Manager was in the process of pursuing disciplinary action with HR for the employee when the employee formally resigned an is now no longer working for the medical center.

Issue: A medical student's shift handoff tool was left unsecure in a public area and found by a nurse manager. The shift handoff tool that included personally identifiable information (PII) and protected health information (PHI) of 10 different Veterans currently admitted…

Outcome: Chief of Medicine educated medical students and residents on the requirement to safeguard the shift handoff tools when carrying them on rounds and to ensure they are placed in the gray, locked shredding bins when no longer need. VISN 2…

Issue: A VA employee sent an unencrypted email to approximately 20 other VA employees that had an attachment with the personally identifiable information (PII) of a potential applicant. This application contains his full SSN and information normally in a work application.…

Outcome: Employee was educated on the proper use of PKI and the importance of using it when appropriate.

Issue: A Buffalo Regional Office (RO) employee sent a Veteran's C-file to Rochester Outpatient Clinic because the Veteran was having an exam there. The exam was completed and references the claim file; therefore, the files was in Rochester at the time…

Outcome: Procedures put in place to track documents sent to Regional Benefits Office staff.

Issue: On 03/24/11, it was determined that a Syracuse VA employee, who was not on duty at the time of access, entered her father's (an inpatient in the Intensive Care Unit (ICU), medical record. The employee entered this record to dispute…

Outcome: Employee issued sanctions in the form of a reprimand per HR and Business Office Manager. She was also educated on the requirement to only access a patient's medical record based on a need to know to do her job and…

Issue: Enrollment documentation for 3 Veterans reported missing. The documents contained the name, full SSN, date of birth and protected health information. Update: 04/27/11:The 3 Veterans will receive a letter offering credit protection services.…

Outcome: The enrollment documentation was not located after a search at the Medical Center and Outpatient Clinic locations. Veteran's Outreach Staff have been re-educated on the proper procedures when transporting and dropping off Veterans PHI/PII at Medical Center and Outpatient Clinic…

Issue: A patient gave a hand written paper to a counselor today that contained the full name, full SSN and full date of birth of 5 other patients that are in this program. He told them that he had written down…

Outcome: Credit monitoring letters sent out. Patient removed from program.…

Issue: An employee was dissmantling a file shelving unit from the area previously occupied by the Health Information Management Service (HIMS) file room when a patient's administrative record was found lying underneath the shelving unit. Shortly after, the Contractor's employee turned…

Outcome: The record was retrieved from the contracted employee and returned to the HIMS File Room for secure storage.

Issue: A VA Specialty Clinic reported that Patient A received Patient B's appointment letter when receiving his own appointment letter in the mail. Patient A returned the letter to the Specialty Clinic and another letter was sent to Patient B. The…

Outcome: The AO for Urology has educated the Urology Secretary of the requirement to confirm the patient's identity before placing it in the envelope to ensure accuracy when mailing and avoid future errors.

Issue: A nurse on the Inpatient Behavioral Health unit found a Medicine provider's inpatient list on the coffee table in the lounge/waiting room across from the elevators on 7 South. The list contained sensitive information for 22 patients, 2 of which…

Outcome: Chief of Medicine educated residents and medical students on the need to properly safeguard all PHI, including inpatient lists, and properly discard them in the shredding bin when no longer needed.