VA Western New York Healthcare System at Batavia

Issue: Cardiology staff reported that a folder with print outs of cardiology consults and steno pad with list of follow up patients is missing from her desk. Steno pad only had patients still needing follow up. Any completed ones were removed…

Outcome: 09/10/14: The Incident Resolution Service Team determined that the 13 Veterans will receive a letter offering credit protection services. 09/25/14: On further review only 10 Veterans were involved, and only three of them had full SSNs disclosed. Those three will…

Issue: A VA employee accessed a sensitive electronic medical record without permission and outside the scope of employee's VA assigned roles and responsibilities.

Outcome: 09/10/14: The Incident Resolution Service Team determined that the Veteran will receive a HIPAA letter of notification.…

Issue: Staff member (former Police Officer) reports that Police cut lock on his locker and went through his items. He had been working with Chief of Police to empty the locker this week. The locker had many personal and employee records…

Outcome: 09/02/14: The Privacy Officer (PO) will talk with the Police Chief. This is a former officer who just settled his Human Resources (HR) issues within the past week or so. There is a long standing history with the individuals who…

Issue: The Privacy Officer was reviewing a Release of Information request for redaction of 7332 information. The Privacy Officer noticed several requests for one Veteran were granted in full. Each was reviewed to confirm that no 7332 information was in the…

Outcome: 08/22/14: The Incident Resolution Service Team has determined that Veteran A will be sent a 7332 notification letter.…

Issue: Veteran A complained that he had met LPN on line dating. He stated that the LPN made comments that she accessed records of Veterans to find more information out about them and could access his records.

Outcome: 01/29/15: The Incident Resolution Service Team has determined that a HIPPA notification letter will be sent.…

Issue: The Release of Information (ROI) office sent Veteran A copies of his records. He took the records to a non-VA provider who noted that there were Veteran B's lab results attached. The non-VA provider mailed items back to Health Information…

Outcome: 07/23/14: The Incident Resolution Service Team has determined that no data breach has occurred. The document was seen only by a HIPAA covered entity. Veteran A did not know that Veteran B's information was in his records.…

Issue: Privacy Officer went to new employee orientation and found sign in sheet from evening leisure program left from night before. list contained first and last name, last 4 SSN of 4 veterans, Last name and last 4 SSN for 3…

Outcome: 07/02/14: The Incident Resolution Service Team has determined that four Veterans will be sent a notification letter.…

Issue: Veteran A went to Radiology to obtain a copy of his procedure. He was given a CD. When viewing his procedure he noted that the CD contained images for him and for Veteran B. For Veteran B, the images contained…

Outcome: 06/19/14: The Incident Resolution Service Team has determined that Veteran A will be sent a letter offering credit protection services.…

Issue: Veteran A was given his Daily plan summary at check in at the CBOC. When the provider entered the room, Veteran A showed him that Veteran B's information was stapled to it. The Veteran gave it back to provider.…

Outcome: 06/17/14: The Incident Resolution Service Team has determined that Veteran B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: Release of Information (ROI) Plus software sends a notification to the Privacy Officer when a deceased Veteran's medical records are released. It was noted that ROI staff had released a deceased Veteran's records to Social Security. Upon review, the authorization…

Outcome: 06/16/14: The Incident Resolution Service Team has determined that Veteran A Next of Kin will be sent a NOK notification letter.…