Veterans In Partnership (VISN 11)

Report ID: SPE000000068927, U.S. Department of Veterans Affairs

Reported Entity: VISN 11 Battle Creek, MI

Issue:

A Primary Care Provider removed "recyclable" material for use in a printer/fax machine in their private practice clinic. An unknown amount of records/papers were removed for an unknown number of Veterans. An anonymous complainant has produced one document containing a work schedule for the clinic on one side and a progress note on the other (indicating it had been run through the printer at the clinic). More investigation is needed to understand how many other Veterans may be impacted. Update: 11/28/11: The Privacy Officer (PO) is scheduled to inspect the practice and their records in the evening of 11/29/11. The PO will update with the findings the morning of 11/30/11. 12/02/11: On 11/29/11 the Private Clinic in Coldwater, MI was inspected by the Battle Creek VAMC Privacy Officer and the Clinic Office Manager. During the inspection 12 VA Veteran medical records were discovered in administrative files and medical records that had other information printed on the blank side pertaining to the private clinic. The clinic manager and PO had agreed that there were too many records to be able to search all of them that evening and that a small team of people would be needed to complete the records search. The PO left the clinic with the records that had been discovered and informed the clinic manager that he would form a team and make arrangements with the clinic manager to gain access to the clinic ASAP. A team was formed and arrangements were made to have the Provider (a VA Primary Care Provider and the Private Clinic Owner) to be available and present for the inspection on 12/02/11. The Privacy Officer and a small team had agreed to meet the Provider at the private clinic at 1100 on 12/02/11. The team arrived at the Clinic in Coldwater and recieved a phone call from the Battle Creek VAMC ROI Office that a fax had been recieved from the Provider's attorney stating that the Provider would not consent to the search of the clinic and the VAMC team would not be permitted access to her private property. Due to the lack of cooperation on the Provider's part, the number of individuals affected by this breach cannot be realized at this time. 12/12/11: OIG Special Agent in Charge was contacted and discussed the lack of cooperation and any recourse the VAMC may have to retrieve the medical records still in the private clinic. Regional Counsel was also contacted and has sent a letter to the Provider's attorney requesting the records be returned and the facility Information Security Officer (ISO) be allowed to inspect the clinic for VA records. The Provider has been placed on Administrative Leave pending a Professional Standards Board Investigation to be held on 12/16/11. 12/13/11: The Privacy Officer spoke with Regional Counsel on 12/09/11. The Provider has agreed to return all the VA documents. The Privacy Officer is arranging for a meeting this Friday (12/16/11) to facilitate the retrieval of the documents. Once the documents are in VA custody, the Privacy Officer will be able to review and determine the exact count of affected individuals. 12/19/11: The PO has received more documents from the Physician's attorney. Most of the documents were redacted; the documents that were not had minimal PII (not enough for Credit Protection Services or HIPAA notification). The Physicians attorney is to be coordinating with the PO and ISO for a date and time for final inspection of the office.

Outcome:

Primary Care Physician has resigned following the Professional Standards Board. Notification letters and Credit Monitoring Letters have been sent to the individuals confirmed to be affected by this breach. HHS/OCR complaint was filed regarding the Private Clinic's failure to properly safeguard the information and has been assigned OCR transaction number CU-12-137859.