Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
ST MARY MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on June 6, 2012. Also cited in 55 other reports.
Report ID: UVPJ11.01, California Department of Public Health
Reported Entity: ST MARY MEDICAL CENTER
Issue:
Based on interview and record review, the facility failed to protect Patient A's medical information. This breach caused Patient A's protected health care information to be released.Findings:The facility self-reported that a hospital employee disclosed Patient A's protected health information (Test results) to another person without Patient A's consent. During an interview with the health information officer on 6/20/12 at approximately 3:50 PM she stated, "While patient was out of the room, the nurse came and told the (Family member, who was with the patient) of the x-ray result." Review of the letter dated 5/25/12 that was mailed to Patient A, stipulated that the test result findings were disclosed to a family member without her consent.Review of the policy and procedure titled "Confidentiality Policy" revised 1/20/12 under Policy 3.0 - stipulated, "Employees are required to follow all policies and patient information, and to comply with all safeguards applicable to the employees's work area and the employee's scope of duty in order to ensure that business and patient information is safeguarded at all times."The policy also stipulated that the employee will follow all policies and procedures, Standards of Conduct, and will take all precautions to prevent any intentional or unintentional use or disclosure of patient health information without the signed authorization of the patient.Review of the policy and procedure titled "Disclosures to Family & Friends for Notification, treatment or Payment Purposes" dated 1/2012 stipulated, when the patient is present, may disclose the PHI (Protected Health Information) if patient's verbal agreement was obtained, documented within the patient's medical record.
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights