MERCY HOSPITAL OF FOLSOM

Report ID: 5UQQ11, California Department of Public Health

Reported Entity: MERCY HOSPITAL OF FOLSOM

Issue:

Based on interview and facility's record review, the facility failed to prevent unlawful and unauthorized disclosure of Patient's Health Information (PHI) when an unintended recipient received a fax with the patient's PHI. This failure had the potential to jeopardize the privacy of PHI including sensitive confidential and personal information.Findings:During an interview on 5/19/14 at 9:40 a.m., with the Health Information Manager, she confirmed, she had, "inadvertently sent a fax to the wrong recipient. That day was very busy." Information included: Emergency physician notes, radiology report and a cardiology report, the patients name, age, date of birth, gender, medical record and account numbers, procedure, date of service,location, medications, diagnosis, physician's name, symptoms, lab results, EKG results, and vital signs. She explained she had quickly placed the fax number and failed to double check the number before sending the fax.During an interview with the Imaging Supervisor, on 5/19/14 at 9:55 a.m., she confirmed, the breach of PHI was self reported as soon as a call was received from the unintended recipient outside of the hospital.A review of undated facility's policy and procedure, titled, "Fax Procedure and Device Maintenance"... instructs staff to visually verify the correct fax number is entered before sending.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280