HEMET VALLEY MEDICAL CENTER

Report ID: UC1411, California Department of Public Health

Reported Entity: HEMET VALLEY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 5). Patient 5's confidential information was given to Patient 6 when Patient 6 was discharged from the Emergency Department (ED) on March 8, 2014. This resulted in the unauthorized disclosure of Patient 5's PHI.Findings:On March 25, 2014, at 4:16 p.m., an interview was conducted with the Director of Health Information Management (DHIM). She stated: a. On March 8, 2014, Patient 6 was seen, discharged and provided with a prescription from the facility ED.b. On March 9, 2014, Patient 6 attempted to fill the prescription at a local pharmacy and was denied because the prescription contained the personal information of another patient (Patient 5).c. On March 9, 2014, Patient 6 returned the prescription with Patient 5's PHI to the facility ED.d. The Physician's Assistant placed the incorrect patient identification label on the prescription given to Patient 6 and the Licensed Vocational Nurse who gave the prescription to Patient 6 did not verify the patient name on the prescription prior to giving the prescription to Patient 6.Patient 6 had an opportunity to view Patient 5's PHI, which included name, date of birth, medical record number, visit identification/account number, gender, and date of service.Patient 5 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on March 14, 2014, to her last known address.The California Department of Public Health (CDPH) was notified via a facsimile dated and received on March 14, 2014, of the unauthorized access of Patient 5's PHI.The facility policy and procedure titled "Discharge Instructions" revised/reviewed August 2013, revealed "... Verify that documents provided to patients upon discharge pertain to the correct patient. This includes discharge instructions, prescriptions, or any other patient identifiable materials. ..."The facility policy and procedure titled "Breach of PHI - Notification Requirements" reviewed/revised September 2013, revealed "... The Hospital shall report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the nearest regional office of the California Department of Public Health no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ... The Hospital shall also report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the affected patient or the patient's representative at the last known address, no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280