VA Mid South Healthcare Network (VISN 9)

Report ID: PSETS0000086166, U.S. Department of Veterans Affairs

Reported Entity: VISN 09 Memphis, TN

Issue:

A VA Patient was discharged by a nurse at GI Lab for outpatient procedure, and was inadvertently given the wrong medical records which had another patient's personally identifiable information (PII). When the patient left the hospital he realized that he was given medical records with PII pertaining to another VA patient so he quickly called the GI lab and spoke with a VA Physician who oversees the GI lab. The records contains PII such as full name, last four of SSN, etc. Update: 02/27/13:One Patient will be sent a notification letter due to PHI being disclosed.

Outcome:

During the fact-finding process, two VA staff accepted full responsibility for the incident, but explained that it happened by accident. A staff from the GI Lab entered patient data incorrectly into Endoworks system during pre-procedure session which subsequently rolled over into CPRS. A Nurse responsible for Post-procedure care should have verified patient PII before providing him with the discharge records which showed another patient PII. Both VA staff have been educated on VA Privacy and Information Security Policies and requirements. PO has referred them to their Service Department Supervisors for further counseling and education to prevent this type of incident from happening again at the GI Lab in the future. PO determined that the incident may have resulted in PII (full SSN and DOB) compromise since the patient took the discharge records home before calling back to the medical center to notify staff.PO has scanned and attached redacted copy of the notification letter; incident is considered closed as of 3/20/2013. Summary report of the fact-finding has been forwarded to supervisors of the two VA staff who were investigated for this incident.