RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: 4K5R11.01, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 5). Patient 5's confidential information, prescription medication, was given to Patient 4's family member when Patient 4's family member went to the facility's pharmacy to pick up Patient 4's medications on October 9, 2013. This resulted in the unauthorized disclosure of Patient 5's protected health information (PHI).Findings:On October 21, 2013, at 10:35 a.m., an interview was conducted with the Compliance Officer (CO). She stated: a. On October 9, 2013, Patient 4's family member came to the facility pharmacy to obtain Patient 4's medications. b. On October 10, 2013, Patient 5 came to the facility pharmacy to obtain his medications and the medications were not available.c. The pharmacy's investigation revealed Patient 5's medications had been given to Patient 4's family member on October 9, 2013.d. On October 10, 2013, Patient 4 was called by Pharmacy Staff, informed she had received the incorrect medications, and Patient 4 returned the medications belonging to Patient 5 to the pharmacy. Patient 4 and Patient 4's family member received and had an opportunity to view Patient 5's PHI, which included name, date of birth, telephone number, address, name of medications to include dosage and frequency of administration, and physician's name.Patient 5 was informed of the disclosure of his protected health information (PHI) via a letter dated and mailed on October 16, 2013, to his last known address. The California Department of Public Health (CDPH) was notified via a telephone call on October 16, 2013, of the unauthorized access of Patient 5's PHI.The facility policy and procedure titled "Patient Identification" released May 23, 2012, revealed "The Policy and Procedure establishes a standard process to verify patient identity, using two unique identifiers, when providing care, treatment, and services. ... Patient Identifiers ... patient full name, patient date of birth, photograph of patient ..."The facility policy and procedure titled "Outpatient Product Quality and Safety Concerns" revised December 2011, revealed "... Pharmacist Dispensing Prescription and Counseling the Patient (OUT Window): Match patient's receipt with paper work in the bag (use the double check method, name and receipt number); Verify with person at window the name of the patient; Empty the contents of bag onto the counter and verify paperwork, prescriptions and vials are for patient; ..."There was no indication in the facility policy and procedure in regards to how the Pharmacy Technician/Pharmacy Office Assistant were to identify and give filled prescription medications to the outpatients who came to the pharmacy to pick up their medications.The facility policy and procedure titled "Breach of Patient Privacy: Reporting Requirements" dated September 23, 2009, revealed "... Whether the complaint involves the unlawful or unauthorized access to, or the use or disclosure of, a patient's medical information ... the violation will be reported to the patient and State within no more than five (5) calendar days from identification of the unlawful or unauthorized access to, or use or disclosure of the patient's medical information. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

7 other violations reported on the same date. Note that other citations may be about the same event: 11CG11.01, 21NM11.01, 5C6Q11.01, CP0L11.01, CP0L11.02, CP0L11.03, WKHE11.01