COMMUNITY HOSPITAL OF THE MONTEREY PENINSULA

Report ID: BFVP11.01, California Department of Public Health

Reported Entity: COMMUNITY HOSPITAL OF THE MONTEREY PENINSULA

Issue:

Based on interview and record review, the hospital failed to report unauthorized access of a patient's medical information to the affected patient no later than five business days after the unauthorized access was detected by the hospital for one of one sampled patient (1). The unauthorized access of Patient 1's record was detected on 11/19/12. The patient was notified by letter on 12/6/12. Findings:During an interview on 1/7/13 at 11:30 a.m., the privacy officer (PO) stated Patient 1 was a hospital employee. The PO stated due to the potential for employees to access Patient 1's record, she and her assistant performed an audit of staff who had accessed Patient 1's electronic record, including what was seen, and when. She stated the 11/28/12 audit indicated six employees (EA, EB, EC, ED, EE, and EF) had accessed the record without a legitimate business reason to do so, in violation of hospital policy and procedure. During further interview on 2/6/13 at 11:57 a.m., the PO stated the audit of Patient 1's record began on 11/14/12. She stated the first detection of possible unauthorized access was on 11/19/12 and the Department of Public Health was notified. She stated the audit was completed on 12/5/12 and the patient was notified by letter on 12/6/12. On 1/7/13 review of a copy of a letter from the hospital to Patient 1 indicated he was informed of unauthorized access of his medical record on 12/6/12.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

The report containing this deficiency also includes information about 1 other violation. Note that these may be related to the same event: BFVP11.02

3 other violations reported on the same date. Note that other citations may be about the same event: PZSO11.01, QO3211.01, Y9EL11.01