VALLEY CHILDREN'S HOSPITAL

Report ID: 9V5011.01, California Department of Public Health

Reported Entity: CHILDRENS HOSPITAL CENTRAL CALIFORNIA

Issue:

Based on staff interview, clinical record review, and administrative document review, the facility failed to ensure confidential treatment of protected health information (PHI) when:1. Patient 1's prescription form was given to the family of Patient 2. (CA00391847)2. Patient 3's prescription form was given to the family of Patient 4. (CA00391875)3. Patient 5, 6, 7, 8, 9, 10, and 11's insurance reimbursement checks were mailed to an incorrect medical group. (CA00391075)4. Patient 12's excuse note for school was given to Patient 13. (CA00387932)5. Patient 14's electroencephalogram results and discharge summary were faxed to a private residence. (CA00387943)6. Patient 15's excuse note for school was given to Patient 16. (CA00390173)These failures resulted in unauthorized access to Patient 1, 3, 5, 6, 7, 8, 9, 10, 11, 12, 14, and 15's confidential information and the potential for abuse of that information.Findings:CA003918471. On 3/21/14 at 11:42 a.m., during an interview, the Accreditation Coordinator (AC) stated Patient 1's prescription was included in Patient 2's discharge packet. The AC stated Registered Nurse (RN) 1 did not verify the names on all of the forms in the discharge packet before she gave the packet to Patient 2's family. The PHI disclosed included Patient 1's name, birth date, address, medical record number, home telephone number, and prescribed medication.The facility policy and procedure titled "Confidentiality" dated 8/11, indicated, "...Policy: It is the policy of [facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential by [facility] and/or by specific legal statutes shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from [facility] premises under any circumstances whatsoever..."CA003918752. On 3/21/14 at 11:47 a.m., during an interview, the Accreditation Coordinator (AC) stated Patient 3's prescription was included in Patient 4's discharge packet. The AC stated Registered Nurse (RN) 2 did not verify the names on all of the forms in the discharge packet before she gave the packet to Patient 4's family. The AC stated RN 3 interpreted for RN 2. RN 3 did not verify the names on all of the forms in the discharge packet. The PHI disclosed included Patient 3's name, birth date, address, medical record number, home telephone number, and prescribed medication.The facility policy and procedure titled "Confidentiality" dated 8/11, indicated, "...Policy: It is the policy of [facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential by [facility] and/or by specific legal statutes shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from [facility] premises under any circumstances whatsoever..."CA003910753. On 3/21/14 at 11:51 a.m., during an interview, the Accreditation Coordinator (AC) stated Patient 5, 6, 7, 8, 9, 10, and 11's insurance reimbursement checks were mailed to an incorrect medical group. The AC stated a facility employee in the Cash Application and Patient Accounting Department did not check the medical group name on the checks and mailed the checks to the incorrect medical group. The PHI disclosed included Patient 5, 6, 7, 8, 9, 10, and 11's name and account number.The facility policy and procedure titled "Confidentiality" dated 8/11, indicated, "...Policy: It is the policy of [facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential by [facility] and/or by specific legal statutes shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from [facility] premises under any circumstances whatsoever..."CA003879324. On 3/21/14 at 12:01 p.m., during an interview, the Accreditation Coordinator (AC) stated Patient 12's school excuse note was given to the family of Patient 13. The AC stated the Registered Nurse (RN) 4 did not check the name on the excuse note against the name on the wristband of Patient 13. The PHI disclosed included Patient 12's name and account number. The facility policy and procedure titled "Confidentiality" dated 8/11, indicated, "...Policy: It is the policy of [facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential by [facility] and/or by specific legal statutes shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from [facility] premises under any circumstances whatsoever..."CA003879435. On 3/21/14 at 12:05 p.m., during an interview, the Accreditation Coordinator (AC) stated Patient 14's electroencephalogram (EEG) and discharge summary were faxed to a private residence. The AC stated a Requisition of Information Technician (ROIT) did not verify the fax number and did not use the facility automated system. The PHI disclosed included Patient 14's name, date of birth, medical record, EEG results, and discharge summary.The facility policy and procedure titled "Confidentiality" dated 8/11, indicated, "...Policy: It is the policy of [facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential by [facility] and/or by specific legal statutes shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from [facility] premises under any circumstances whatsoever..." CA003901736. On 3/21/14 at 12:09 p.m., during an interview, the Accreditation Coordinator (AC) stated Patient 15's school excuse note was given to Patient 16's family member. The AC stated the Ambulatory Service Representative did not verify name on the excuse note with the name on Patient 16's wristband prior to giving the note to Patient 16's family member. The PHI disclosed included Patient 15's name and account number.The facility policy and procedure titled "Confidentiality" dated 8/11, indicated, "...Policy: It is the policy of [facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential by [facility] and/or by specific legal statutes shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from [facility] premises under any circumstances whatsoever..."

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: DV8J11.01