SAN ANTONIO REGIONAL HOSPITAL

Report ID: HY9P11, California Department of Public Health

Reported Entity: SAN ANTONIO COMMUNITY HOSPITAL

Issue:

Based on interview and record review, the facility failed to ensure the confidential treatment of protected health information (PHI) for Patient A, when a Radiology clerk (X-ray clerk) released a radiology report containing Patient A's PHI to Patient B. This failure resulted in an unauthorized release of PHI for Patient A.Finding:On August 6, 2014 at 3:30 PM, a phone interview was conducted with the Director of Nursing Operations (DNO) regarding an entity reported incident of a breach of PHI for Patient A, which occurred on March 23, 2012. The DNO stated, "Two identifiers are to be used when releasing any paperwork, both the patients name and date of birth, or name and account number before releasing paperwork."During a review of the of the documentation, the radiology report given to Patient B contained Patient A's name, date of birth, date, time, type and reason for x-ray exam and medical record number.A review of the facility policy and procedure titled, "Confidentiality, Protecting Confidential Information," dated July, 2011, indicated, "Confidential information must be protected from unauthorized uses; disclosures....must be protected to prevent financial fraud and identity theft."The failure of the X-ray clerk to follow facility policies resulted in the unauthorized release of Patient A's PHI to Patient B.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights