MERCY HOSPITAL OF FOLSOM

Report ID: H51G11.01, California Department of Public Health

Reported Entity: MERCY HOSPITAL OF FOLSOM

Issue:

Based on staff interview and record review, the facility failed to prevent unauthorized access of Patient Health Information (PHI) when Patient 1's Radiology Procedure Requisition was faxed to the wrong number.Findings:The Department of Public Health received a self report dated 11/14/13, via facsimile, that the facility detected potential unauthorized access of Patient 1's medical information.In an interview with X-Ray Tech 1 (XRT 1), on 5/19/14, at 2:40 p.m., XRT 1 stated the breach occurred when she placed X-Ray results form in a basket, then another staff member faxed a requisition to a medical supply agency in Ohio. XRT 1 stated she thought the papers got stuck together when faxed to Ohio.In an interview with the Imaging Director (ID) on 5/19/14, at 2:47 p.m., he stated the papers were stuck together when they were faxed to a medical supply agency in Ohio. He stated it was a single incident, one paper was faxed.Review of the facility document titled, "Privacy & Data Security Incident Intake", dated 11/7/13, indicated the Radiology Procedure Requisition contained the following PHI:1. Patient 1's name;2. Medical Record number;3. Date of birth/age;4. Name of procedure;5. Account number;6. Date of service;7. Medication; 8. Technician notes; and9. Gender.The CDPH verified that the hospital informed the Department within the mandated time frame.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

5 other violations reported on the same date. Note that other citations may be about the same event: 3RNM11.01, CF2K11.01, MVLG11.01, O64R11.01, S3G711.01