August 26th, 2011 James Alan Bush 1211 East Santa Clara Avenue #4 San Jose, California 95116

(408) 791-4866 United States Department of Health & Human Services Office for Civil Rights 50 United Nations Plaza, Room 322 San Francisco, California 94102 (415) 437-8310 In re violation of medical privacy rights by Dr. Dean Winslow, M.D., and the Santa Clara County Department of Correction To the United States Department of Health & Human Services, Office for Civil Rights: This letter concerns the violation of my medical privacy rights as an inmate at the Santa Clara County Department of Correction, and, in particular, the unauthorized and unlawful disclosure by Dr. Dean Winslow, M.D., of my HIV-positive status to jail staff and other inmates, which adversely affects the safety and security of all similarly situated inmates. Beginning on July 20th, 2009, and every two months since, Dr. Winslow has unlawfully disclosed private medical information whenever an inmate has a scheduled appointment with the P.A.C.E. Clinic, which is known to jail staff and inmates alike for its exclusive treatment of HIV-positive patients. On the day of the appointment, Dr. Winslow distributes a list of inmates having an appointment with the clinic to corrections officers, who then announce to the entire unit in which an inmate is housed that he is scheduled to visit the clinic. The name of the inmate is always listed and spoken in conjunction with the name of the clinic, both on the list and in the announcement; it is by the association of the inmate's name with that of the clinic that his HIV-positive status is made known. Also, while administering medications commonly known for the treatment of HIV/AIDS, nurses announce the names of the inmate's medications loudly enough for others to hear, allowing for inmates to infer his condition. (Enclosed is a copy of the list distributed by Dr. Winslow to jail staff, which is read aloud by corrections officers to inmates; also enclosed is a grievance form submitted by me to jail administration, in which jail and medical staff admit to unlawfully disclosing private medical information.) Although I have informed Dr. Winslow, jail administration, and Santa Clara Valley Health & Hospital System Custody Health

Services of this issue, adequate protective measures against further unauthorized disclosure have not been instituted. Consequently, HIV-positive inmates are exposed to a pervasive risk of harm, i.e., a strong likelihood of violence by other inmates, by the continued unauthorized disclosure. The purpose of the Health Insurance Portability and Accountability Act Privacy Rule is to establish appropriate safeguards that health care providers and others must achieve to protect the privacy of health information; specifically, the Privacy Rule requires any health care provider to: 1. 2. 3. 4. 5. Notify patients about their privacy rights and how their information can be used; Adopt and implement privacy procedures for its practice; Train employees so that they understand the privacy procedures; Designate an individual to be responsible for seeing that the privacy procedures are adopted and followed; and, Secure patient records containing individually identifiable health information so that they are not readily available to those who do not need them.

Neither Dr. Winslow nor the Santa Clara County Department of Correction meet these requirements, in that patient-inmates are not notified of their privacy rights, and employees, such as pillcall nurses, are not trained to maintain the confidentiality of a patient-inmate's prescription records; moreover, Dr. Winslow and the Santa Clara County Department of Correction have failed to provide for the implementation of security safeguards as required by Section 530(c)(1) and (c)(2) of the Privacy Rule, even though 45 C.F.R. 164.530(c) specifically states that (1) a covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information, and (2) a covered entity must reasonably safeguard protected health information from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or other requirements of this subpart. Please be advised that this letter is a follow-up to a similar one received by your office on May 18th, 2010. On March 25th, 2010, an employee of the Office for Civil Rights, namely, Mr. Michael F. Kruley, Regional Manager, stated that your office would conduct an investigation of the aforementioned violation, and would then contact me when results were obtained. To-date, no one from your office has contacted me with any results. Accordingly, I am requesting that the Office for Civil Rights conduct its obligatory informal investigation of the failure to properly implement adequate privacy practices and procedures by Dr. Winslow and the Santa Clara County Department of Correction. Kindly note that this letter of complaint complies with the

requirements of the Office for Civil Rights in all respects, except that the initial disclosure occurred more than 180 days ago. Accordingly, I am requesting an extension of the 180-day period in which complaints may be filed because I was unable to report the privacy violation in a timely manner due to my incarceration, which ended only three weeks ago; moreover, no information for reporting violations to the Office for Civil Rights is provided to inmates, thus precluding the filing of a timely complaint. Also note that, although Dr. Winslow is a physician contracted by the Santa Clara County Department of Correction, he is an employee of the Ira Greene P.A.C.E. Clinic, which is located at 2400 Moorpark Avenue, Suite 316B, San Jose, California 95128; the Santa Clara County Department of Correction is located at 885 North San Pedro Avenue, San Jose, California 95110.

Sincerely,

James Alan Bush

Enclosure(s):

List of Inmates with P.A.C.E. Clinic appointments Inmate Grievance Form Letter from the Office for Civil Rights