Phoenix VA Health Care System

Report ID: PSETS0000110261, U.S. Department of Veterans Affairs

Reported Entity: PHOENIX AZ - 644

Issue:

Today, 10/09/14, the mailroom reported the return of packages by USPS that were mailed by the facility on 09/25/14. There were five packages mailed but only four have returned. The packages are damaged and wholly or partially opened. The packages were sent in plastic bags not boxes. There are no protective mail covers per VHA Directive 6609. The contents are over 1600 document sets, no page count, of medical records, including the Veteran's name, home address (erroneous perhaps), contact information, and complete medical records including 38 USC 7332 diagnosis.

Outcome:

10/10/14: ROI+ is the tracking software for protected health information (PHI) disclosures. It shows that 1600 document sets were compiled of medical records for one person. This was a 5-year span of his medical records. The actual page count is too high to enumerate. This was the totality of the 5 packages. One package is still missing. However, all sources list the same mailing address, even the HIPAA authorization that he signed. It does not appear to be our error. The Release of Information (ROI) Supervisor will call Veteran later today. 10/20/14: No update at this time. 10/22/14: The Release of Information (ROI) Supervisor indicates that all 5 packages of medical records were recovered. The likelihood of exposure is minimal due to agency to agency secure processing from facility to USPS and back. The Incident Resolution Service Team has determined that this was a USPS delivery issue. This is not the fault of VA.