The U.S. is in the grips of a prescription drug epidemic, fueled in part by an explosion in opioid prescriptions over the past several decades. Roughly half of those prescriptions are written by primary care doctors. NPR’s Robert Siegel talks with Dr. Wanda Filer, president of the American Academy of Family Physicians, about her experience prescribing opioids and what doctors can do to prevent abuse.

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

Download

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

When Anthony McCann opened a thick manila envelope from the Department of Veterans Affairs last year, he expected to find his own medical records inside.

Instead, he found over 250 pages of deeply revealing personal information on another veteran’s mental health.

“It had everything about him, and I could have done anything with it,” McCann said in an interview.

It wasn’t the first time McCann had received another veteran’s medical records. In the past, he informed the VA, then threw away the misdirected documents. This time, after failing to make contact with the other veteran on his own, McCann took the documents to a town hall meeting held by the director of the VA’s Tennessee Valley Healthcare System.

When the floor opened for questions, McCann was the first to raise his hand.

“I got 256 pages of another person’s extremely confidential, extremely explicit mental health records,” he said, waving the documents in his hands, an exchange captured by local media. When an official asked for the documents back, McCann refused, doubting the VA’s ability to safeguard the material or make sure it ended up in the right hands. “I don’t trust them,” McCann told ProPublica. “They don’t do what they say they’re going to do.”

Employees and contractors at VA medical centers, clinics, pharmacies and benefit centers commit thousands of privacy violations each year and have racked up more than 10,000 such incidents since 2011, a ProPublica analysis of VA data shows.

The breaches range from inadvertent mistakes, such as sending documents or prescriptions to the wrong people, to employees’ intentional snooping and theft of data. Not all concern medical treatment; some involve data on benefits and compensation.

Many VA facilities and regional networks are chronic offenders, logging dozens of violations year after year.

The VA’s Sunshine Healthcare Network, which includes Florida, Puerto Rico and southern Georgia, has had more privacy incidents than any other region, with at least 370 over the past five years, according to ProPublica’s analysis. The C.W. Bill Young VA Medical Center in Bay Pines, Fla., had more privacy reports than any other facility, with 112 incidents. (ProPublica’s new tool, HIPAA Helper, allows you to read reports on these incidents and search by facility.)

In an interview Tuesday, a VA official said the department considers patient privacy a top priority and that it fares well in comparison with health providers and insurers in the private sector, some of which have been targets of cyberattacks this year. The VA runs the largest integrated health care system in the nation, with 150 hospitals and hundreds of clinics that collectively serve around 9 million patients annually.

“We take any loss of data very seriously,” said John Oswalt, the VA’s associate deputy assistant secretary for privacy and records management. “Over a third of our employees are veterans. … We have a vested interest in protecting the data personally, too.”

The VA also released a written statement that said, in part, “Inappropriate access of patient health records, either during or post treatment, is absolutely unacceptable and in violation of privacy laws and regulations, VA policies and procedures, and our principles.”

Responsibility to act on privacy violations falls both to the VA itself and to the Office for Civil Rights within the Department of Health and Human Services. That’s the agency charged with enforcing the Health Insurance Portability and Accountability Act, the federal patient privacy law known as HIPAA. The civil rights office has cited the VA more frequently than any other health provider in the nation, yet it has not sanctioned the VA or publicly identified it as the top HIPAA violator.

VA facilities were the subject of more than 300 privacy complaints to the Office for Civil Rights from 2011 to 2014. In 220 cases, the VA submitted a corrective-action plan or received “technical assistance” on how to comply with the law. (See our previous story.)

Two senators told ProPublica they found the volume of privacy breaches involving the VA to be deeply troubling.

“It’s just one more area in which the VA fails to operate in a way that’s worthy of our veterans,” said Kansas Republican Sen. Jerry Moran, a frequent critic of the VA who serves on the Senate Committee on Veterans’ Affairs. “There’s 127 community hospitals in Kansas. I have visited each and every one of them. When I visit a hospital, you can sense that they are very cautious about what I see and what I hear when it involves a patient. … That same kind of attitude ought to exist at the VA.”

The VA provides monthly reports to Congress on data breaches and posts them on its website, but these reports don’t contain all of the incidents provided to ProPublica under the Freedom of Information Act.

Moran said he would support requiring the VA to report all privacy incidents to Congress.

In fact, from 2011 to 2014, the number of reports per year nearly doubled, from 1,547 to 3,054.

A 2013 investigation by the Pittsburgh Tribune-Review found that privacy violations were rampant within the VA, affecting tens of thousands of veterans. ProPublica asked for the data provided to the newspaper, as well as all privacy violations since then. The number of reported incidents has increased, the data show.

In fact, from 2011 to 2014, the number of reports per year nearly doubled, from 1,547 to 3,054.

The VA’s Oswalt said the increase is less a result of a growing problem and more an indication that the VA has been successful in encouraging employees to report potential breaches.

“I think we have a pretty good track record of getting people to report when they make a mistake or when they observe something happening,” he said. “If we were out there punishing people for human error, I think you would see the number of reported incidents go down, but that doesn’t serve the needs of the veteran.”

Under HIPAA, medical providers are responsible for keeping patients’ medical information confidential. Releasing a patient’s treatment information without consent is illegal. VA employees who have access to medical records are only supposed to access the minimum necessary in order to perform their jobs.

The majority of the VA privacy incidents appear to be inadvertent ones —medical records left in waiting rooms or faxed to the wrong recipient, for example. But even unintended errors can cause grief, particularly in the case of mistaken identities.

There were several cases of widows who received letters extending sympathy for the death of unrelated veterans and outlining survivor compensation and burial benefits for those veterans.

The privacy incident reports also reveal more systemic issues across the VA: Employees repeatedly accessed the medical records of patients not under their care, from co-workers to suicidal vets to whistleblowers.

For example, in September 2011, after a veteran committed suicide on the grounds of a VA facility in Biloxi, Miss., more than 40 employees accessed his medical records. In response, the VA provided training and a reminder about privacy laws and sent the veteran’s family a letter informing them of the violation.

Two years later, a VA employee who worked at the same facility in Biloxi committed suicide and, again, several co-workers inappropriately snooped in the medical records.

In January 2015, a veteran who works at C.W. Bill Young VA Medical Center attempted suicide. Afterward, many co-workers who had no direct involvement in his medical care seemed to know about his attempt and asked how he was doing. Following an investigation, the VA’s incident response team found that an employee had indeed inappropriately accessed the veteran’s medical records “out of curiosity.”

The problems were noted both within the VA’s internal data and in letters sent by the Office for Civil Rights to the VA when it closed its complaint investigations. (Patients can complain to the VA, the Office for Civil Rights or both.)

Some VA employees have used their access to medical records as a weapon in disputes or for personal gain, incident reports show.

A patient treated at the West Virginia VA Medical Center had his medical records impermissibly accessed by co-workers of his wife. His records were then used against him during divorce proceedings, according to a May 2013 letter from the Office for Civil Rights.

A VA employee at C.W. Bill Young VA Medical Center suspected that his ex-girlfriend, a nurse at the facility, accessed his Social Security number from his confidential medical files in order to change his AT&T account information. He requested a list of everyone who looked at his file, which revealed that his ex-girlfriend had accessed it 55 times. According to the Office for Civil Rights investigation letter from November 2012, the ex-girlfriend was suspended for 10 days, given training and the incident was documented in her employment record.

As the VA’s overall problems have mounted in the past couple years — including long waits for care — some whistleblowers contend that HIPAA has been used as a sword against them. Some have reported being accused of violating HIPAA for collecting material to inform members of Congress about care problems at the VA. Others say their own medical records were looked at by co-workers and officials without their consent.

“This is a problem that is widespread throughout the VA,” said Brandon Coleman, a VA whistleblower who testified before the Senate that his private medical records were inappropriately accessed by a co-worker. “I realized right away that she had no right to be in there. She had never treated me and had nothing to do with my medical care.”

Coleman, an addiction therapist for the Phoenix VA Health Care System who is on administrative leave, said a social worker mentioned during a meeting in October 2014 that she had accidentally accessed his medical file a few months earlier. Coleman said he was horrified and filed a complaint with the privacy officer at the Phoenix VA.

Shortly after he came forward in December 2014 to the Office of Special Counsel, a federal office that handles whistleblower allegations for the VA, Coleman was placed on administrative leave, for allegedly threatening other employees. While on leave, he discovered that yet another administrative officer at the VA, who was also not involved with his medical care, accessed his health files after he filed his complaint with the Office of Special Counsel.

“They come up with ways to try to discredit you or say you are unfit for duty,” said Coleman, who is still on leave nearly a year later. “There is zero accountability.”

Another VA whistleblower, Dr. Katherine Mitchell, was inappropriately investigated for a privacy violation after she came forward with allegations of patient harm.

Mitchell, a physician who has worked at the VA for over 16 years, contacted the office of Sen. John McCain, R-Ariz., in 2013, alleging that the Carl. T. Hayden VA Medical Center in Phoenix didn’t provide adequate care for its suicidal veterans and that the hospital statistically manipulated its patient wait list.

Mitchell submitted a formal report through the senator’s office, hoping that a congressional push would secure a review by the VA’s inspector general. However, shortly after she submitted her request, she was placed on administrative leave and investigated for alleged privacy violations: Her superiors told her that she had violated privacy laws by accessing the records of the suicidal veterans she alleged had not received adequate care.

“It’s not a violation to provide that information to your congressman to request an investigation into inappropriate behavior,” said Mitchell, who believes that many whistleblowers are investigated for merely trying to bring attention to flaws in the system.

The VA’s internal records indicate that its incident response team found that Mitchell accessed at least 15 patients’ charts without “proper authorization.” But a recent VA accountability review found that Mitchell’s actions were indeed protected because she was acting as a whistleblower, and her placement on leave was deemed to be retaliatory.

“The management uses HIPAA rules inappropriately to prevent whistleblowers from speaking up,” said Mitchell, who received the VA’s Public Servant award the year after her allegations. “If they don’t report the cases, no one will investigate.”

The experiences of Coleman and Mitchell were reflected in recent testimony from Carolyn Lerner, who heads the Office of Special Counsel. Lerner expressed concern that VA employees are accessing whistleblower medical records to discredit their claims. She emphasized that the VA should consider “system-wide corrective action” to better protect whistleblowers.

“Quite simply, it is too easy right now for a mischief-minded employee to enter the medical record system and access information on his or her coworkers,” Lerner wrote in her written testimony. “A better ‘lock’ on the system would potentially eliminate, and certainly reduce, this problem.”

Sen. Richard Blumenthal of Connecticut, the ranking Democrat on the Senate Committee on Veterans’ Affairs, said he too is concerned about this.

“Nothing is more devastating and unconscionable than the misuse of power to subjugate legitimate complaints,” he said in an interview. Blumenthal has proposed a bill, called the VA Patient Protection Act, which, among other things, would punish VA supervisors or employees who retaliate against whistleblowers.

“The VA still has a significant way to go in restoring trust and credibility,” he added, “and part of that task is to take sufficient disciplinary action against wrongdoers so as to deter them and reassure all veterans that it has a very strict standard of accountability.”

In its statement, the VA told ProPublica that it will not tolerate any retaliation “against those who raise issues which may enable VA to better serve Veterans.”

“Complaints that VA receives from whistleblowers about inappropriate access to their health records are thoroughly investigated and appropriate actions are taken where warranted,” said the VA.

This story is part of a yearlong examination into how secure medical privacy is. Has your medical privacy been compromised? Help ProPublica investigate by filling out a short questionnaire. You can also read other stories in our Policing Patient Privacy series.

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

Guinea is set to celebrate with concerts and fireworks Wednesday, following the World Health Organization’s announcement that the country is now officially Ebola-free.

On Tuesday, WHO declared that after two years and over 2,500 deaths, the Ebola epidemic in Guinea has officially ended. The announcement marks the passing of two 21-day incubation periods since the last person to have contracted Ebola — a baby girl called Noubia — was cured of the virus.

“Of course people are happy,” says Safiatou L. Diallo, a World Bank operations officer based in Conakry, Guinea. “But the mood here is also very humble. People have lost their entire families, and we are still remembering and mourning that.”

The announcement in Guinea is a milestone, because “this is the first time that all three countries — Guinea, Liberia and Sierra Leone — have stopped the original chains of transmission that were responsible for starting this devastating outbreak two years ago,” said WHO regional director for Africa Dr. Matshidiso Moeti in a statement.

“But at the same time it’s important to emphasize that this is not the end of Ebola forever,” Dr. Daniel Lucey, a professor of immunology at Georgetown University, who has worked at Ebola treatment wards in Sierra Leone and Liberia.

For the next three months, Guinea will be in a state of heightened surveillance to make sure the virus doesn’t re-emerge as it has done twice in Liberia. “The virus in some cases can persist in the semen of men who’ve survived the infection for up to nine or even 12 months,” Lucey explains. People can also contract the virus from animals.

Plus, in some survivors, the after-effects can include blurred vision, hearing loss and joint pain.”Clearly now is not the time to slow down,” Lucey says. It’s a time to build up health infrastructure, and continue developing and testing vaccines and anti-viral treatments to prepare for any future flare-ups, he says.

The World Bank, WHO and other aid groups have said they will continue to work with the governments in Guinea as well as Sierra Leone and Liberia to provide survivors with medical care as well as counseling to help them return to normal life.

Diallo from the World Bank points out that the epidemic has also left hundreds of children orphaned. Several local associations as well as international groups are now working to find homes for these children and get them back to school, she says. “But unfortunately this may take a long time. And they will need lots of support — they will be affected forever by the epidemic.”

There is also the issue of stigma against survivors, Diallo adds. Over the next year, public campaigns explaining that it’s safe to live and work around Ebola survivors, to shake their hands or breathe the same air will be crucial.

The epidemic had been especially difficult to contain in Guinea. As NPR’s Ofeibea Quist-Arcton reported earlier this year, mistrust, anger and denial in parts of the country hindered efforts to cure the infected and curb the spread of illness.

“No one expected it to be so hard or take so long to stop this disease. It just demolished entire villages and families,” Diallo says. “It will take some time to rebuild.”

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

A Veterans Affairs hospital in Tucson, Ariz., is expanding treatment to a previously underserved faction of the armed services: transgender veterans.

It’s one of the first VA hospitals in the country to open a clinic devoted specifically to the needs of veterans like Sue McConnell.

“In 1994 I was diagnosed with PTSD. I was also dealing with the fact that I was a woman,” McConnell says.

McConnell came out as transgender while serving with the Navy in Vietnam, which meant leaving the military. Coming out took a personal toll as well and her family has shunned her, but she says she simply had no choice.

“I had to be who I am, no matter the cost,” she says.

McConnell is one of more than 130 transgender veterans receiving treatment at the Tucson VA. Due to the high demand for these services, the women’s clinic at the hospital is now devoting one day a month to the expansion of care for transgender veterans.

“We have been flooded with phone calls since we’ve announced that the clinic will be opening — patients from all over wanting to know about it, to be able to take advantage of this opportunity,” says Sonia Perez-Padilla, the women’s clinic director. She’s now also in charge of the transgender clinic, which includes a psychologist, social workers, clinical pharmacists and a therapist.

In 2011, the VA central office issued a directive that all Veterans Affairs hospitals begin to provide care for transgender veterans. That’s when Perez-Padilla’s women’s clinic began offering treatment for gender dysphoria, which replaced the previous diagnosis of gender identity disorder.

“There’s nothing wrong with these veterans, OK? They’re unhappy because there’s a mismatch between who they are and their biological organs, but it’s not a disorder at all,” she says.

Aside from hormone treatment and psychiatric care, the clinic offers a peer support group, something McConnell found helpful as she attempted to embrace her true identity.

“The transgender support group gives us an outlet where we can talk about things that we need to talk about — such as clothing, makeup — you know, how to dress, how to act,” she says.

But she says the best therapy is knowing she’s not alone. “It’s kinda like, oh, wow, there is somebody else like me,” McConnell says.

Evan Young, a retired Army major and president of the Transgender American Veterans Association, says with so much recent attention paid to gays and lesbians in the military, he feels transgender service members and veterans have been overlooked.

“I get calls — daily — from veterans that have experienced discrimination,” Young says. “When ‘don’t ask, don’t tell’ was repealed, we kinda got left back in the closet.”

While gays and lesbians can now serve openly in the military, transgender people still can’t. However, Defense Secretary Ash Carter created a working group in 2015 that’s charged with ending the ban. And the VA issued another directive in 2013 clarifying and extending the range of procedures their hospitals are to provide to trans vets.

But Young says despite the progress, transgender veterans are still turned away at some VA hospitals. “For a lot of people, it’s your last hope, and when you get that crushed, there’s nowhere else to go,” Young says.

While many veterans’ hospitals around the country offer a range of services for trans vets, the Tucson VA as well as the VA in Cleveland are among the few that offer a standalone clinic.

While the VA offers pre- and post-operative treatment for trans vets, it does not cover the cost or perform gender reassignment surgery. Perez-Padilla says covering the surgery would be the next logical step as the VA moves to providing equal care to everyone.

“If a veteran has an onset of cancer or a heart condition and needs a transplant — anything that might arise after they’ve served, we take care of it. We serve all who have served,” Perez-Padilla says.

Because she says, regardless of gender identity, all of her patients identify as veterans.

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

When CVS Health customers complained to the company about privacy violations, some of the calls and letters made their way to Joseph Fenity. One patient’s medication was delivered to his neighbor, revealing he had cancer. Another was upset because a pharmacist had yelled personal information across the counter.

Fenity worked on a small team that dealt with complaints directed to the company president’s office, assuring customers their situations were rare. “I sincerely apologize on behalf of CVS Health,” Fenity says he’d respond. “This is not how we handle things. The breach of your protected health information was an isolated incident and we’ll do better.”

In fact, Fenity learned – partly from battling CVS over the privacy of his own medical information – that was “a lie.”

CVS is among hundreds of health providers nationwide that repeatedly violated the federal patient privacy law known as HIPAA between 2011 and 2014, a ProPublica analysis of federal data shows. Other well-known repeat offenders include the U.S. Department of Veterans Affairs, Walgreens, Kaiser Permanente and Walmart.

And yet, the agency tasked with enforcing the Health Insurance Portability and Accountability Act took no punitive action against these providers, ProPublica found.

In more than 200 instances over those four years, that agency, the Office for Civil Rights within the U.S. Department of Health and Human Services, reminded CVS of its obligations under the law or accepted its pledges to improve privacy protections. (CVS did pay a $2.25 million penalty in 2009 for dumping prescription bottles in unsecured dumpsters.)

To be sure, the organizations with the most HIPAA violations are all large health care providers with many locations that serve millions of patients each year. In statements, they said they take privacy seriously. (Walmart declined to comment.)

“CVS Health is strongly committed to protecting the privacy of our patients’ health information,” CVS spokesman Mike DeAngelis wrote. “We have established rigorous privacy policies and procedures throughout the Company to safeguard patient information.”

Over the course of this year, ProPublica has reported on loopholes in HIPAA and the federal government’s lax enforcement of the law. A story earlier in December detailed how the Office for Civil Rights only rarely imposed sanctions for small-scale privacy breaches that caused lasting harm.

The data analyzed for this story shows the problem goes beyond isolated incidents, carrying few consequences even for those who violate the law the most.

“The patterns you’ve identified makes a person wonder how far a company has to go before HHS recognizes a pattern of noncompliance,” said Joy Pritts, a health information privacy and security consultant who served as chief privacy officer for HHS’ Office of the National Coordinator for Healthcare Information Technology until last year.

Pritts said the government is supposed to take into account a health provider’s prior track record of following the law when deciding whether to pursue fines for privacy violations. “You have to ask whether that’s happening,” she said.

The VA was the most persistent HIPAA violator in the data. Time and again, records show, VA employees snooped on one another and on patients they weren’t treating. One employee accessed her ex-husband’s medical record more than 260 times. Another employee peeked at the records of a patient 61 times and posted details on Facebook. A third improperly shared a vet’s health information with his parole officer.

All told, VA hospitals, clinics and pharmacies violated the law 220 times from 2011 to 2014. For this story, ProPublica counted as violations those complaints that resulted in either corrective-action plans submitted by a health provider or “technical assistance” provided by the Office for Civil Rights on how to comply with the law.

The VA has never been called out publicly by the Office for Civil Rights or sanctioned for its string of violations.

The VA would not make an official available for an interview, but said in a written statement that it “takes veteran privacy and the privacy of medical or health records very seriously.”

“The challenges VA is facing are similar to those experienced across public and private sectors, and we are continuously striving to better protect veteran data,” its statement said, adding that it provides training to staff, investigates complaints and conducts audits of who accesses health records.

Some privacy problems—whether inadvertent or the deliberate acts of rogue employees—are to be expected. But repeated complaints may signal organizational failures, experts say.

“I don’t think it’s a defense to just say, ‘We do a billion prescriptions a year,'” said Mark Rothstein, chair of law and medicine and the founding director of the Institute for Bioethics, Health Policy and Law at the University of Louisville School of Medicine. “They need to be more assertive to try to figure out what’s wrong. It may be true that you can’t get down to zero, but you need to make a really good faith effort to follow up on the complaints that were filed.”

OCR has broad latitude in deciding how to handle complaints. It can resolve them privately and informally, as it has chosen to do in the vast majority of instances. It also has the authority to impose fines of up to $50,000 per violation, with an annual maximum of $1.5 million. In the most egregious cases, the agency can file criminal charges against violators. It is also free to post complaints online, if it protects patients’ identities.

Deven McGraw, deputy director for health information privacy at the Office for Civil Rights, said the agency’s top priority has been investigating breaches that affect at least 500 people, which providers are required by law to report promptly. “Often, when we take a look into those breaches, what we find is that they were not accidents,” she said. “What contributed to the breach of thousands, if not tens of thousands of records, was systemic noncompliance…over a period oftentimes of years.”

Still, McGraw acknowledged, more can be done about health providers with multiple HIPAA violations.

“I don’t like the idea of repeat offenders not being called to task for that behavior and I would like to see us doing more in this regard,” she said, adding that the office’s case management system in the past was an impediment but is now being fixed to proactively flag them.

Although the Office for Civil Rights receives thousands of complaints a year — nearly 18,000 in 2014 — it issues only a handful of financial penalties. The agency posts details online about the fines violators have agreed to pay (fewer than 30 since 2009), as well as a listing of large breaches. But that represents a tiny share of the incidents investigated by the office; the rest has been hidden from the public.

Asked why the office did not post details of repeat violations online, spokeswoman Rachel Seeger wrote in an email: “Entities who are the subject of complaints are not necessarily guilty of a crime or a civil wrong. Our office makes public details of cases that result in settlements and formal corrective action agreements or civil monetary penalties on our website.”

Despite the VA’s status as the top serial HIPAA violator in ProPublica’s analysis, McGraw said, “that doesn’t mean that we treat them any differently in terms of our overall enforcement philosophy.”

Using data provided by OCR under the Freedom of Information Act, ProPublica is launching a new tool, HIPAA Helper, which allows users to look up reports of privacy violations by provider for the first time. OCR’s material often referred to the same entities by multiple names. CVS was listed as “CVS,” “Pharmacy, CVS,” “Caremark, CVS,” “CVS Caremark” and more. Kaiser Permanente was identified as “Kaiser Foundation Hospital,” “Kaiser Hospital,” “Kiaser Permanente,” and even “KP.” We have standardized organizations’ names to make searching easier.

The database also includes the large breaches self-reported by health providers to the Office for Civil Rights, privacy incidents logged separately by the VA and violations cited by the California Department of Public Health, which can impose its own fines against hospitals for failing to protect patient privacy. (Read our methodology.)

Two reports issued this fall by the HHS inspector general faulted the Office for Civil Rights’ case-tracking system for its inability to track repeat offenders.

The Office for Civil Rights said it is taking steps to fix those problems.

To gain a better understanding of the nature of the complaints received by OCR, ProPublica requested dozens of letters sent by the office to health providers detailing the allegations and how they were resolved.

In the case of CVS, common complaints included giving drugs to the wrong patients, speaking too loudly when discussing health information in front of customers, and faxing medical information to the wrong places (including to random strangers).

Many of the letters culminate with the admonition: “Should OCR receive a similar allegation of noncompliance against CVS in the future, OCR may initiate a formal investigation of that matter.”

But that doesn’t seem to have happened.

DeAngelis, the CVS spokesman, said the company’s 200,000 employees who work in pharmacies, medical clinics and call centers are required to complete privacy training when they are hired and every year afterward. That’s in addition to regular on-the-job-training on privacy practices, he wrote.

Walgreens ranked third for the number of privacy complaints resolved with corrective actions or technical assistance, ProPublica’s analysis showed. Spokesman Jim Graham said in an email that the company “takes the privacy and security of our customers’ information very seriously. Walgreens thoroughly investigates any concern about privacy regardless of how it is brought to our attention and will voluntarily improve practices if necessary.”

Beyond the cases in OCR’s data, there have been other incidents indicating that Walgreens sometimes struggles with patient privacy. In 2013, an Indiana jury ordered the company and one of its pharmacists to pay $1.44 million because the pharmacist looked in a patient’s prescription records and told her ex-boyfriend that she had stopped taking birth control pills before becoming pregnant. The verdict was upheld by the Indiana Court of Appeals.

Nicolas Terry, a professor and executive director of the Hall Center for Law and Health at Indiana University’s law school, said the Office for Civil Rights has moved more aggressively in recent years to impose fines against health providers that have had large-scale breaches or have done “dumb things,” such as a cardiology group that used a publicly accessible online scheduling system. Still, he said, the agency could do more.

“If you see the same offender continuing along the same line of conduct, then at some point, you’ve got to ramp up and say, ‘You are not taking the hint that we are dropping,’ ” Terry said.

For patients whose medical information is exposed, the effects can be far-reaching.

The breach involving Fenity occurred in September 2014, when he couldn’t refill a prescription for a controlled substance — a medication to treat Attention Deficit Hyperactivity Disorder — at a CVS pharmacy and called the company’s helpline (as required) for permission to get the drug elsewhere.

All CVS employee calls were routed to the center in San Antonio where Fenity worked, and he soon discovered that a co-worker who assisted with the call hadn’t kept his inquiry confidential. Walking down a hall a couple of days later, Fenity heard the co-worker mention his name and the medical lingo used to describe controlled substance overrides.

Deeply shaken, he told a supervisor and, after investigating, the company fired the co-worker and counseled two others who were told the information. Fenity remained so anxious and embarrassed by the incident that he took a leave of absence. (He was terminated this August for not returning.)

“It was incredibly difficult for me to reassure members that we would appropriately handle their [personal health information] or take accountability by working to avoid any additional HIPAA violations when I was experiencing the complete opposite,” he said in an email.

After trying to resolve the issue within the company, he filed a privacy complaint against CVS with the Office for Civil Rights. He said he believes the company’s systems for protecting his health data were —and still are — inadequate. It is pending.

CVS’s DeAngelis said the company investigated Fenity’s complaint promptly and fired the employee to blame.

DeAngelis also noted that employees can request that their calls be routed to a single employee who “would be the only representative authorized to access their prescription account. In fact, following Mr. Fenity’s incident, this option was offered to him and he accepted.”

Fenity can still recall the chill of realizing the information about his medication was out.

“It’s like feeling your clothes have been ripped off in the middle of work,” he said. “That’s what it feels like. You feel so exposed.”

This story is part of a yearlong examination into how secure medical privacy is. Has your medical privacy been compromised? Help ProPublica investigate by filling out a short questionnaire. You can also read other stories in our Policing Patient Privacy series.

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

Every once in a while a technology comes along that completely alters the way scientists do their work.

It’s hard to imagine astronomy without a telescope or high energy physics without an accelerator.

From here on in, it’s going to be impossible to imagine biology without CRISPR-Cas9.

Simply put, CRISPR-Cas9 allows scientists to make specific changes to specific genes in living cells. Such a thing was possible in the past using technques called zinc finger nucleases and Talens. But those techniques were cumbersome and weren’t widely adopted.

In the three short years since the first scientific papers appeared about CRISPR-Cas9, the technique has been “spreading like wildfire,” says Ramesh Akkina, a molecular immunologist at Colorado State University.

And for 2015, the journal Science called CRISPR the “breakthrough of the year.”

There’ve been lots of ethical debates about what the new gene editing technique could do, such as creating designer babies or making mutant species.

But most biologists aren’t interested in making designer babies or mutant species. They just want to understand basic things like how the cells in our bodies work, or how certain genes function. They expect CRISPR-Cas 9 to be very, very helpful with those lines of inquiry.

Recently I visited Colorado State University to give a talk, but I realized it would be a great place to assess just how far and wide CRISPR-Cas9 had spread.

First, I talked with Christopher Allen, a scientist in the environmental and radiological health sciences department who studies the genes that are important for repairing DNA inside our cells.

When that repair process goes wrong, the result can be cancer. So Allen would like to be able to compare cells side by side: one that has a gene he thinks is important in the repair process, and one that is missing that gene. To do that, he has to modify the genome of a cell, something CRISPR-Cas9 will let him do easily.

Another scientist named Carol Wilusz studies how and when genes are expressed in stem cells. She says CRISPR-Cas9 is going to make a difference in her work, “because it’s going to enable us to enable us to do experiments that we’ve been struggling to do through other approaches.”

Now Wilusz and Allen aren’t trying to cure diseases, at least not directly, but CRISPR might be useful for that, too.

“The work we’re doing now is to use CRISPR-Cas technology to delete HIV genome from infected cells, such that the cell can be cured completely, says Ramesh Akkina, a virologist at Colorado State University. Right now he’s perfecting that trick in cells in the lab, but he’s working on a scheme to do it in patients as well.

CRISPR-Cas9 isn’t just useful for working organisms in the animal kingdom. It’s useful in forests and fields.

“I study diseases of plants,” says plant geneticist Jan Leach, “and my goal is to try to make plants that are resistant to different pathogens,”

She says there are a host of genes inside plant cells that turn on when the plant tries to fight invasion from bacteria or fungi. She’d like to be able modify all of them. With CRISPR-Cas9, she can.

“I’ve been working in this particular area for over 20 years, and in 20 years I’ve been able to do one or two genes,” says Allen. “With CRISPR-Cas I’ll be able to do 20 or 30.”

In two days, I spoke with 9 different researchers. I asked them all the same question. “Will CRISPR-CAS9 have an impact on your work?”

Honestly, it’s stunning to witness the impact CRISPR Cas9 has had on biology. It ranks with the most important tools invented in the last century. I wouldn’t be surprised if it wins Science magazine’s breakthrough of the year next year too.

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

About 5.3 million Americans have Alzheimer’s disease, the latest statistics suggest, and it’s likely about as common on Native American reservations as anywhere else. But a diagnosis in Indian Country is rarer, say mental health workers. That’s likely at least partly because of a cultural belief — many Native American communities don’t recognize dementia as a disorder.

“In fact, many tribal communities do not have a word for dementia,” says Dr. Anna Burke, a geriatric psychiatrist and specialist in dementia care at Banner Alzheimer’s Institute, in Phoenix, which runs an outreach program to Native American communities in the southwest and beyond.

“They simply see aging and this more childlike behavior as the circle of life closing in on itself,” Burke says. People begin life as children, and leave as children. But that acceptance can leave many families feeling isolated, and less likely to reach for support and resources that could help.

Delma Salazar, her husband and three kids were living in Los Angeles eight years ago when her sister called about their mother, Agnes Williams, who had lived her whole life in the Salt River Pima-Maricopa Indian Community, southeast of Phoenix, in rural Arizona. Their mother kept forgetting things and getting lost, the sister said.

“I didn’t know what Alzheimer’s was,” Salazar says. “Nobody’s ever talked about it. Maybe it’s an embarrassment.”

As the memory problems grew worse, Salazar brought her mother to live with her family in Los Angeles. But Williams had never been outside her community. In Southern California, she kept running away and forgetting where she was.

“It was one night — I was sleeping in the living room, and I remember waking up and watching her walk into the kitchen,” Salazar said. “And she just looked up, she looked around and she was wondering where she was.” That’s the scariest part of the illness, Salazar says. “I realized — she really doesn’t know.”

In her rare moments of clarity, Williams would say she was desperate to go home. So eventually the family moved with her, back to the reservation.

Williams has 14 kids, many of whom live in the area. But Salazar says she is the only one caring for her mom.

“I don’t know if they are scared to see her like that,” Salazar says. “I know they say they have their own family now. It hurts that nobody visits.” Salazar says she feels guilty, too, that she initially doubted her mother, when the older woman said she couldn’t remember things.

Nicole Lomay, who travels to the Arizona tribes as community outreach representative for Banner Alzheimer’s Institute, says Salazar’s story is very common.

“The people come to me,” Lomay says, “and tell me, ‘I didn’t know! I didn’t know that my wife is having symptoms of Alzheimer’s disease — and I was giving my wife a hard time. I thought she was just getting on my nerves. I thought she was doing it on purpose.’ “

Lomay, who is Navajo, has a grandfather with dementia.

“He was herding sheep in his truck,” Lomay recalls. “So, they were allowing him to drive to the location where these animals are. With my own family — they didn’t have the resources, at all.”

Banner Alzheimer’s Institute holds workshops for health care providers and social workers, teaching them how to do memory screenings, talk to families and lead support groups.

Salazar says she doesn’t have time to go to support group meetings, but having an understanding of the disease does help. She has learned to cherish the rare moments when her mom wakes up and laughs or shows a glimmer of her old self.

“We’ve always been close,” Salazar says. “So to see her be that strong, Native woman — always cooking, always cleaning, trying to plant her own garden — that was a whole different picture compared to now, and it’s hard.”

Her mother’s Alzheimer’s has progressed beyond the beginning stages. She has to be led to the kitchen to eat and to her bed to sleep. Often, she reverts to her Native language — Akimel O’odham — but her daughter can’t understand her.

When I visit the family in their home, Delma Salazar sits close to her mom in their living room. I ask Agnes Williams her age.

“How old am I,” Wiliams repeats. “Yes. I don’t even know. Eighty-nine. Eighty-nine, I guess.”

Williams looks for a minute as though she’s trying to complete a puzzle, then gives up and falls asleep. Delma Salazar gently reaches over and covers her mother with a fuzzy purple blanket.

This story was produced by KJZZ’s Fronteras: The Changing America Desk.

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.

A novel immunotherapy drug is credited for successfully treating former president Jimmy Carter’s advanced melanoma. Instead of killing cancer cells these drugs boost the patient’s immune system, which does the job instead.

Immunotherapy is cutting edge cancer treatment, but the idea dates back more than 100 years, to a young surgeon who was willing to think outside the box.

His name was William Coley, and in the late summer of 1890 he was getting ready to examine a new patient at his practice in New York City. What he didn’t know was that the young woman waiting to see him would change his life and the future of cancer research.

Her name was Elizabeth Dashiell, also known as Bessie, says Dr. David Levine, director of archives at the Hospital for Special Surgery in New York. Bessie was 17 and showed up complaining of a problem with her hand. It seemed like a minor injury, just a small bump where she’d hurt it, but it wasn’t getting better, and she was in a lot of pain. She’d seen other doctors but nobody could diagnose the problem.

At first Coley thought Bessie must have an infection. But when he took a biopsy, it turned out to be a malignant, very advanced cancer called a sarcoma.

In those days there wasn’t very much anyone could do for Bessie. This was before radiation and chemotherapy, so Coley did the only thing he could — he amputated Bessie’s right arm just below the elbow in an attempt to stop the disease from spreading. Sadly, it didn’t work, and within a month, according to David Levine, the cancer had spread, “to her lungs, to her liver and all over her body”.

Bessie’s final days were wrenching and painful. Coley was with her when she died on January 23rd, 1891. Bessie’s death made a huge impression on the young surgeon. “It really shocked him,” says Stephen Hall who wrote about Coley in his book A Commotion in the Blood: Life, Death and the Immune System.

Bessie’s death also spurred Coley into action. There wasn’t a lot known about cancer at the time, so Coley started digging through dozens upon dozens of old records at New York Hospital. He was looking for something that would help him understand this cruel and aggressive disease.

As a student, Coley had read Charles Darwin, and one of the lessons he took away from Darwin, Hall says, was to always pay attention when there’s a biological exception to the rule. “To ask yourself, why this has happened?”

Coley discovered one of these biological exceptions. It was the case of a German immigrant named Fred Stein. Stein had been a patient in New York Hospital eight years earlier. He had a tumor on his neck that doctors tried to remove several times. Unfortunately for Stein, the tumor kept coming back and doctors expected him to die from the disease.

Then Stein contracted a serious infection of the skin caused by the strep bacteria. “It looked like Stein’s days were numbered,” Levine says. But Stein didn’t die. In fact, his tumor disappeared, and he was discharged. Coley wondered if all these years later, Stein could still be alive.

So in the winter of 1891, William Coley the surgeon became William Coley the detective. He headed for the tenements of the Lower East Side of Manhattan where the German immigrant community lived. He knocked on door after door asking for a man named Fred Stein who had a distinctive scar across his neck. After several weeks of searching, Coley found him alive and cancer free.

So why did Fred Stein’s cancer go away and stay away after he got a bacterial infection? Coley speculated that the strep infection had reversed the cancer. and wondered what would happen if he tried to reproduce the effect by deliberately injecting cancer patients with bacteria.

He decided to test his idea on people who were the most seriously ill. His first subject was an Italian immigrant named Zola who, just like Bessie Dashiell, was suffering from sarcoma. Zola had tumors riddling his throat. He was so sick he could barely eat or speak or even breathe. For months Coley would try to make Zola sick from infection by creating little cuts and rubbing the strep bacteria into them, Hall says. There would be “a slight response but not too much.”

Then Coley got his hands on a much stronger strain of the bacteria. This time, Zola became violently ill with an infection that could easily have killed him. But within 24 hours Zola’s orange-sized tumor began to liquefy and disintegrate. “This was a phenomenon that occurred rarely, but when you saw it you were utterly astonished,” Hall says.

Zola completely recovered. Coley knew he was on to something. He kept experimenting and refining his use of bacteria. Eventually, he named the treatment Coley’s toxins.

It was an exciting time. Coley was having tremendous success and his efforts were celebrated in America and abroad. But Bradley Coley Jr., William Coley’s grandson, says the American medical establishment at the time was skeptical. Nobody knew how Coley’s toxins worked, or why they worked some times and not others. Even Coley himself couldn’t explain it.

That’s largely due to the fact that the immune system was still a mystery and would remain so for decades to come.

When radiation therapy came along in the early 1900s, interest in Coley’s toxins was completely overshadowed by this new therapy. When his grandfather died, Bradley Coley says, “All interest in [Coley’s toxins] stopped.”

And quite possibly, that’s where Coley’s legacy would have ended except for this: After Coley’s death in 1936, his daughter, Helen Coley Nauts, started looking through her father’s papers while doing research for his biography. She found about a thousand files of patients her father had treated with Coley’s toxins.

She spent years carefully analyzing these cases and could see that he had extraordinary rates of success in regressing some cancerous tumors. She couldn’t get anyone interested in studying her father’s work, so she decided to do it herself. With a small grant, in 1953 Helen Coley Nauts started the Cancer Research Institute, dedicated to understanding the immune system and its relationship to cancer.

In the more than 60 years since, researchers have expanded their understanding of the immune system dramatically and today, that understanding is paying off. Treatments that harness the power of the immune system are now available for a range of cancers such as stomach, lung, leukemia, melanoma and kidney.

Jedd Wolchok, chief of the melanoma and immunotherapeutics service at Memorial Sloan Kettering Cancer Center, says any treatment currently in use that exploits the power of the immune system to fight cancer has to “tip its hat” to the work William Coley began more than 100 years ago.

This entry passed through the Full-Text RSS service – if this is your content and you’re reading it on someone else’s site, please read the FAQ at fivefilters.org/content-only/faq.php#publishers.