Scripps Mercy Hospital

Report ID: 3M5111.01, California Department of Public Health

Reported Entity: SCRIPPS MERCY HOSPITAL

Issue:

Based on interview and document review the hospital failed to ensure that Patient 1's personal and protected health information (PHI) was kept confidential when Patient 2 was discharged and given a document that contained Patient 1's medical information. As a result of this failure, Patient 2 had access to Patient 1's personal information.Findings:An investigation of an entity reported privacy breach was initiated on 12/9/13. It was reported to the California Department of Public Health that, on 11/27/13 an unauthorized and inadvertent disclosure of Patient 1's medical information was given to Patient 2 upon discharge from the hospital. On 12/13/13 at 12:49 P.M., an interview was conducted with the Coordinator, Patient Relations/Risk Management (CPRM). The CPRM stated that both Patient 1 and Patient 2 had the same first name and came to the hospital with medications from home. CPRM stated that the process when medications from home were brought into the hospital was that, the nurse was to fill out the "Patients Own Medications (POM)" form. The form had three copies, one was given to the patient, one was placed into the medical record and the third stayed on the envelope with the medications and given to the pharmacy to hold until the patient was discharged. CPRM stated that the nurse put Patient 1's form into Patient 2's medical record. CPRM stated that when Patient 2 was discharged from the hospital that Patient 1's POM was part of the discharge papers that was given to Patient 2. Patient 2 went to the pharmacy and was given Patient 1's medications. The POM form for Patient 1 was reviewed with CPRM. The POM contained Patient 1's name, date of birth (DOB), account number, medical record number, the medications name, doses, and the physician name.On 12/13/13 at 2:21 P.M., an interview was conducted with the Pharmacy Technician (P.T.) 1. P.T. 1 stated that when a patient was discharged from the hospital that they bring the POM to the pharmacy to receive their home medications. P.T. 1 stated that the process was to check two identifiers (name, DOB) when patients were picking up their home medications. P.T. 1 stated that she saw Patient 2 still had her arm band on, but that she had not looked to verify the name, or asked Patient 2 her DOB and therefore did not follow the process. On 1/2/14 at 3:00 P.M., an interview was conducted with the Registered Nurse (RN) 7. RN 7 acknowledged that she was the nurse that had discharged Patient 2. RN 7 stated that the process for discharge to verify the correct paperwork was given to the correct patient, was to use the label on the paperwork and the patients ID bracelet. RN 7 stated that she missed the checking of Patient 2's ID bracket prior to giving her the POM.A review of the hospital's policy and procedure, entitled "Health Information, Access, Use and Disclosure", dated 9/13, indicated "B. Validate identity and authority Under all circumstances, validate identity and authority of individuals requesting/receiving information..."The Registered Nurse's failure to follow the policy and procedure to validate the identity of Patient 2 prior to giving her the POM, resulted in the inadvertent and unauthorized release of protected health record information. This was also in violation of the patient's right to confidentiality of all communications and record pertaining to health care received at the hospital.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: 1LQL11.01