EISENHOWER MEDICAL CENTER

Report ID: HU1N11, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure for one patient (Patient A), that her protected health information (PHI) was not disclosed to an entity not authorized to receive the information. Patient A's PHI was inadvertently sent to the wrong insurance company. This failure resulted in unauthorized access of Patient A's PHI.Findings:An interview was conducted with the Information Privacy Officer (IPO) on May 29, 2014, at 2:25 p.m. The IPO stated on February 22, 2014, a Business Associate's staff member inadvertently sent Patient A's PHI to the wrong insurance company. The IPO stated the PHI included the patient's name, service dates, date of birth, account number and billed charges.A copy of the letter sent to Patient A was reviewed. The letter indicated: "...notify you that a letter of appeal containing your name, claim number, services dates, date of birth, facility account number, and billed charges was inadvertently sent to the incorrect insurance carrier by a vendor who handles billing and collection agreed to destroy the documents."The facility's policy and procedure titled "HIPAA - (Health Information Portability and Accountability Act) Use and Disclosure of Protected Health Information," revised November 18, 2014, was reviewed. The facility's policy was "To protect the patient's rights to privacy and confidentiality, at no time will names or information be shared with any person who does not have a need to know..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280