VA Western New York Healthcare System at Batavia

Issue: During a Release of Information (ROI) audit, the Privacy Officer (PO) noted that ROI had released a note that contained a 7332 protected diagnosis to an outside provider's office in response to a written request. No authorization to release 7332…

Outcome: 06/06/14: The Incident Resolution Team has determined that Veteran B will be sent a HIPAA notification letter due to Protected Health Information (PHI) being disclosed.…

Issue: During audit of new Release of Information (ROI) staff, the Privacy Officer (PO) noted that ROI staff released 7332 information to a disability insurance company without proper authorization. The notes released had 7332.

Outcome: 05/01/14: The ROI clerk released the information without proper authorization. The VA did not contact the insurance company to have the information returned. The Incident Resolution Team has determined that a HIPAA notification letter will be sent to the patient.…

Issue: An Employee/Veteran complained that a Union official disclosed why he was out, including his protected health information (PHI), to a co-worker.

Outcome: 05/06/14: OR staff who originally told the Veteran of breach was contacted by the Privacy Officer (PO) and confirmed the allegations that had happened. Upgrading to incident. The PO prepared the package for supervisor for action. 05/09/14: The Incident Resolution…

Issue: IT staff found a gains and losses sheet for 04/04/14 in the kiosk next to the canteen store. She secured the list and brought it to the Privacy Officer (PO). The list contains 82 Veterans' full name, last 4 digits…

Outcome: 04/07/14: Per the PO, the list was printed 04/05/14, and found 04/07/14 at approximately 7:30 AM. The PO is checking to see if there are any cameras in the area. 04/08/14: Per the PO, there are no cameras in area.…

Issue: The Privacy Officer (PO) received a complaint from Veteran A that his neurologist had been video recording him during appointments. Veteran A described provider using personal cell phone to record him holding out his hands. Provider in question is off.…

Outcome: 04/07/14: PO update: Confirmed that provider has been recording veterans without authorization and using it in presentation to residents. Cell phone was reviewed by ISO, all images were deleted. 04/07/14: The Incident Resolution Team has determined that there was a…

Issue: Release of Information (ROI) was notified that a lawyer received information (medical records) with another Veteran's information mixed in with the request he received. ROI instructed lawyer to destroy the wrong Veteran's records.

Outcome: 03/25/14: The Incident Resolution Team has determined that Veteran B will be sent a letter offering credit protection services.…

Issue: Staff in charge of Combined Federal Campaign reported that he lost a completed form from one employee. Form contains name and SSN. has work phone and address not home.…

Outcome: 03/07/14: The Incident Resolution Team has determined that the employee will be offered credit protection services, as his full SSN was potentially disclosed.…

Issue: Veteran A was given wristband for Veteran B. The wristband had full name, full SSN and date of birth. Veteran A relayed the information to his wife who contacted patient advocate and Director. The wristband was removed and the correct…

Outcome: 03/05/14: The Incident Resolution Team has determined that Veteran B will be sent a letter offering credit protection services.…

Issue: There was a report from the Nurse Manager that Veteran A stated an LPN told two Veterans that one of the Veterans on the unit was a sex offender. The Nurse Manager is beginning an investigation to confirm if this…

Outcome: 02/21/14: The Nurse Manager has interviewed other Veteran on floor at the time and determined/confirmed that the LPN did disclose that one of the Veterans was a sex offender. The Incident Resolution Team (IRT) determined that the Veteran will receive…

Issue: Veteran A was discharged from an inpatient stay on 02/07/14. During his Primary Care follow up call on 02/12/14, he informed the nurse that he was given Veteran B's medication. The label on the bottle contained Veteran B's full name,…

Outcome: 02/12/14: The Incident Resolution Team (IRT) determined that Veteran B will receive a HIPAA letter of notification due to the medication information having been exposed.…