VA Heartland Network (VISN 15)

Report ID: SPE000000067869, U.S. Department of Veterans Affairs

Reported Entity: VISN 15 Marion, IL

Issue:

A Veteran alleges that his ex-girlfriend, who is a former employee at the facility, inappropriately obtained information from his VHA medical records. He stated that she knows medical information regarding his medical provider assignments and medication regimen that he has not shared with her. He stated that she had created a My HealtheVet account without his knowledge. He alleges that he became aware of this when he received notification that his contact information had been changed. He stated that he reported this to the My HealtheVet Coordinator in July 2011, at which time it was confirmed that an account had been created and it had been accessed on multiple occasions. He then asked that his account be closed. Neither the Information Security Officer (ISO) nor the Privacy Officer (PO) was notified of this complaint at that time. He also alleges his ex-girlfriend has placed a number of phone calls to him from this facility. He stated that he would answer the phone calls, thinking it was someone from the VA calling, and she would be on the line. The Veteran stated that he filed a report with the local Police Department on 10/19/11 and also sought a restraining order against this individual earlier this week.The Veteran's record contains his name, address, date of birth, and full SSN. Update: 10/24/11: The Veteran returned today to share a copy of an order of protection (OP) which he stated was served on 10/21/11. The OP contained written statements by the former employee (his ex-girlfriend), confirming that she had placed calls to him from this facility. She stated that she called him "from a phone at the VA" on 09/17/11 and 09/20/1. The ex-girlfriend's statement substantiated the Veteran's allegation that she had created/accessed his My HealtheVet account on 07/29/11. Per her statement, it was "with his permission;" however, he stated that he became aware of the account when someone from My HealtheVet contacted him to notify him of a change in his contact information. Per the My HealtheVet Coordinator, the Veteran's account has been de-activated and no new account has been created. Phone records have been requested to assess calls placed from this facility to the Veteran. VA Police were notified by the Privacy Officer (PO), and a statement was taken from the Veteran for their records. 10/26/11; Telephone records were provided to this writer of all phone calls placed to/from the Veteran's cell phone. Log revealed five questionable calls placed to the Veteran. OI&T staff has been asked to provide location of these phones to assess where calls originated from and to evaluate if the calls were for business purposes. 10/27/11: The Veteran contacted the PO to request a copy of telephone records of all calls placed to him from this facility. The Veteran's ex-girlfriend (former employee of this facility) presented to the VA Police Department on the evening of 10/25/11. At that time, the officers gave her a "stern warning" that she should not place phone calls to the Veteran from this facility. They warned that if she called him from here, she would be in violation of the OP that she had been served with. She voiced understanding of this warning. 11/01/11: The Veteran will receive a letter offering credit protection services.

Outcome:

VA Police talked with the ex-girlfriend on October 28, 2011, when they issued a stern warning to her that if she continued to utilize VA telephones to contact the Veteran, she would be considered in violation of the order of protection and that she could be arrested. She voiced understanding of their warning.

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: SPE000000067878