EISENHOWER MEDICAL CENTER

Report ID: 214S11, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patients' confidential information (Patients 1, 2, 3, 4, 5, 6, 7, 8, and 9). Patient 1 through 9's confidential information was sent to a physicians' billing service through a secured, encrypted electronic portal on October 10, 2014. This was the incorrect physicians' billing service for the care the patients had received. This resulted in the unauthorized disclosure of Patient 1 through 9's protected health information (PHI).Findings:On October 21, 2014, at 10:01 a.m., an interview was conducted with the Information Privacy Officer (IPO). He stated: a. On October 10, 2014, an Emergency Department (ED) Billing/Registration Clerk sent the PHI for Patients 1 through 9 to a physicians' billing service through a secured, encrypted electronic portal.b. On October 13, 2014, the physicians' billing service informed the facility that Patients 1 through 9 had not received services from their physicians on the days indicated. The physicians' billing service stated they had received the PHI for Patients 1 through 9 in error and the PHI for Patients 1 through 9 had been deleted/destroyed.c. Patients 1 through 9 had all received services at the facility but had not received services from the physicians connected with the physicians' billing service within the past 45 days.d. The ED Billing/Registration Clerk had keyed in the incorrect physician name for Patients 1 through 9, and thus the PHI for the patients had gone to the incorrect billing service.The physicians' billing service received and had an opportunity to view Patient 1 through 9's PHI, which included name; date of birth; medical record number; account number; date of service; social security number; gender; address; telephone number; insurance information to include policy numbers; guarantor's information; diagnosis; and next of kin information.Patients 1 through 9 were informed of the disclosure of their protected health information (PHI) via a letter dated and mailed on October 20, 2014, to their last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on October 20, 2014, and a letter dated and mailed on October 20, 2014, of the unauthorized access of Patient 1 through 9's PHI.The facility policy and procedure titled, "Information Privacy" reviewed/revised January 2, 2014, revealed, "... (facility name) will take all necessary steps to avoid unauthorized or unlawful access, use or disclosure of protected health information ... Whenever possible, the Information Privacy Officer will contact the individual or organization to whom the information was inappropriately or unlawfully accessed, used or released and requested that no further access, use or disclosure of the information is made and to return or destroy the information. The Information Privacy Officer will contact the Department of Public Health and report the breach within (5) five days of discovery. The Information Privacy Officer will contact the patient within (5) five days of discovery to inform him or her of the unauthorized access, use of disclosure and the plan or step's taken to mitigate it. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280