Dept.

of Health & Human Services Letter

7/3/12 12:50 PM

Tuesday, June 11th, 2012 James Alan Bush 3311 Princeton Way #5 Santa Clara, California 95051 (408) 791-4866 United States Department of Health & Human Services HIPAA Compliance and Enforcement ATTN: David A. Mayer, Acting Senior Advisor Ofce for Civil Rights Washington, D.C. 20201 In re Transaction Number 12-140127 (formerly 12-112828) To David A. Mayer, Acting Senior Advisor, HIPAA Compliance and Enforcement: I am in receipt of your letter dated May 2nd, 2012, in which you advise that the portion of the above-referenced complaint pertaining to the violation of medical privacy rights of inmates detained by the Santa Clara County Department of Correction by Dr. Dean Winslow, M.D. and other P.A.C.E. Clinic employees would not be investigated because the HIPAA Privacy Rule does not govern medical privacy rights for the P.A.C.E. Clinic. By way of explanation, you cited the portion of my complaint that mistakenly classied the P.A.C.E. Clinic as a subcontractor of the Santa Clara County Department of Correction, and stated that, as such, the aforesaid clinic does not meet the denition of a covered entity. This letter seeks to correct the erroneous assumption on both our respective parts by clarifying the relationship between the P.A.C.E. Clinic and the Santa Clara County Department of Correction. Upon further investigation, I discovered that the P.A.C.E. Clinic operates independently of the Santa Clara County Department of Correction, and is under the management and control of Santa Clara Valley Health & Hospital Systems (SCVHHS) Adult Custody Health Services, the sole provider of medical services to inmates detained by the Santa Clara County Department of Correction, which also operates independently. So, neither of these can enter into any contract with the other; rather, they provide their respective services to inmates separately. In fact, it is the County of Santa Clara that owns and operates both the Santa Clara County Department of Correction and SCVHHS and the P.A.C.E. Clinic. Also, both SCVHHS and the P.A.C.E. Clinic retain an employee to monitor compliance with the HIPAA Privacy Rule, namely, Ya-Hui (Ya-Ya) Hsu, MSN, RN, FNP. Ms. Hsu, QI Manager for SCVHHS, can be reached by phone at (408) 808-5226, by e-mail at Ya-hui.hsu@hhs.sccgov.org or by mail at 150 West Hedding Street, San Jose, California 95110. Moreover, they also distribute to all patients a notice explaining their medical privacy rights

Page 1 of 2

Dept. of Health & Human Services Letter

7/3/12 12:50 PM

(attached). This notice even refers patients to the Ofce for Civil Rights to report any violation of medical privacy rights. Therefore, based on these reasons, the P.A.C.E. Clinic, and, in particular, Dr. Winslow, M.D., and nursing staff are indeed subject to the HIPAA Privacy Rule. Accordingly, I am hereby requesting that you investigate the complaint in its entirety, and not limit your investigation to only the portion pertaining to retaliation, as both the retention of a employee devoted solely to monitoring HIPAA compliance and the written notice to patients of their obligation to comply with HIPAA clearly evidence that SCVHHS is, in fact, a covered entity within the meaning of the aforesaid statute.

Respectfully yours,

James Alan Bush

Enclosure(s): SCVHHS Privacy Notice to Patients (8 pages) cc: Eric Press, Equal Opportunity Specialist, San Francisco OCR Michael Loez, Regional Manager, OCR Region IX

Page 2 of 2