VA Heartland Network (VISN 15)

Report ID: PSETS0000082995, U.S. Department of Veterans Affairs

Reported Entity: VISN 15 Kansas City, MO

Issue:

Incident Summary: VAMC Privacy Officer processed valid Release of Information (ROI) request 10-5345 for release of deceased Veterans medical record to a Law enforcement (Police) department. The valid HIPAA authorization for ROI to the city Police Department was made by the deceased Veterans next of kin. Privacy Incident recognized after the fact by the Privacy Officer was the release of medical records containing 7332 protected information. VA does not have authority under the next-of-kin HIPAA authorization to release 7332 protected health information. Privacy Officer released mistake and took the following steps: self-reported to VISN and VHA Privacy Service, self-reported to VAMC Director, and contacted city Police Department to explain the records released contained information protected under federal statute. Requested city Police return the records for re-processing - re-release. Police agreed to return the records. The criminal investigation for which the records were requested has been closed. The city Police made no disclosure of the medical records received. There is no court or legal actions pending related to the criminal investigation. Update: 11/30/12: The Veterans Next of Kin will be sent a notification letter.

Outcome:

Privacy Officer has requested and received positive assurance from City Police Department Detective that VA Patient Medial Records (deceased) containing protected health information under U.S.C. 7332 will be returned to the VA. City Police confirmed the records remained in their custody (transported by UPS with tracking from VAMC ROI to City Police) The patient medical records were not released to any secondary users, and the City Police investigation prompting the ROI has been closed. Notification letter sent