VA Sunshine Healthcare Network (VISN 8)

Issue: VA employee recently passed away. Audit log was run to acknowledge any unauthorized access. Three VA employees inappropriately accessed the electronic record of this non-Veteran Employee. Update: 12/04/12:The Employee's Next of Kin will be sent a notification letter.…

Outcome: Staff was provided additional education on the right of access; accessing VHA computer systems only for the sole purpose as it relates to their duties. Information was share with the employees supervisors who will contact Human Resources for further disciplinary…

Issue: Veteran A contacted the Ft. Myers Outpatient Clinic to report that he recieved a copy of his medical records at his home address in an unsealed envelope. The records included his full name, full SSN, address and health information. Update:…

Outcome: Staff has been provided further education on safeguarding VA sensitive information while processing requests and handling individually identifiable information.

Issue: An OIG Investigation found the inappropriate disclosures of patient information to third parties (friends of an employee) and the emailing of sensitive information, including personally identifiable information (PII) and protected health information (PHI), to the employee's personal email account. There…

Outcome: The provider's access to patient records has been terminated. Notification letters to patients and NOK have been sent.

Issue: Veteran A picked up his funds for travel and once he left the campus he realized that he had also received a travel manifest which included the full name, full SSN, address, phone number and appointment information of 39 Veterans.…

Outcome: Staff has been provided further education by the Privacy Officer to apply additional safeguards when handling patient information to prevent such incidents from occurring in the future. The supervisor of the responsible employee has been provided information and will pursue…

Issue: An Operating Room file containing the schedule of operations for November 2012 is missing. The VA Police are investigating and the service is performing a search for the file. Update: 11/27/12:The area is access controlled and the VA Police have…

Outcome: Below are the additional security measures taken in the OR: 1. Completed rounds of the entire OR/PACU/SDSU to determine any possible unprotected PHI and evaluation of any process that potentially needed to be changed. 2. Lock installed for cabinet where…

Issue: A Veteran complained that about a year ago, he went to the VA clinic and had some blood work done. Shortly after that he received a phone call from his grandparents concerned about his blood work results. The Veteran states…

Outcome: The employee has completed retraining on Privacy and Information Security. The Clinic Medical Officer has recommended ten days suspension. HIPAA Notification Letter mailed to affected Veteran.…

Issue: An education class has been using a sign in sheet which lists patient names, last 4 of SSNs, length of diagnoses, and manner of treatment (i.e. insulin/pills). The sign in sheet listed PHI of nine patients. It appears that not…

Outcome: Educated provider. Stopped use of form.

Issue: A Program Support Administrator (PSA) working in Voluntary Services inadvertently disclosed 7332-protected information to a volunteer (a Veteran) when she handed the Volunteer an applicant's VA Form 10-0755. The applicant had indicated that he was HIV Positive in the "Restrictions,…

Outcome: The employee has been entered into a personnel improvement plan (PIP).

Issue: Veteran A's informed consent was developed and printed on Veteran B's medical record. It was discovered by the VHA Administrator Officer of the Day (AOD) during pre-admission. Update: 11/09/12:The consent was given to Veteran A during the consent process, placed…

Outcome: Processes reviewed. Employee to attend private course on prevention of medical errors.

Issue: A Veteran provided a signed authorization for a VA provider to communicate about a specific medical condition via telephone with the Department of Health & Human Services (HHS). The VA provider discussed an unrelated condition with HHS which potentially could…

Outcome: The Privacy Office has reiterated to staff that information is only to be shared with third parties as authorized by the patient unless for routine disclosure. Event has been communicated to supervisor for further action.…