RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: TE7K11, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 9). Patient 9's confidential information was provided to an unauthorized insurance carrier who was not Patient 9's insurance carrier. This resulted in the unauthorized disclosure of Patient 9's protected health information (PHI).Findings:On May 6, 2013, at 2:10 p.m., an interview was conducted with the Medical Records Manager (MRM) and Chart Room Supervisor (CRS). They stated: a. On January 29, 2013, a written request from an insurance carrier for records was received by the facility. The request contained patient names, dates of birth, and dates of service, and the facility had to obtain the patient's medical record number by matching it to the name and date of birth provided by the insurance carrier.b. On February 16, 2013, the CSR obtained the medical record numbers for the patients but for Patient 8 on the list, Patient 9's medical record number was provided, and Patient 9's record was provided along with Patient 9's electronic record.c. A copy service for the insurance carrier copied the records provided by the facility to include the incorrect record belonging to Patient 9.d. On March 6, 2013, the MRM was contacted by the insurance carrier who informed her that they had received the records for Patient 9 but had requested the records for Patient 8.The unauthorized insurance carrier received and had an opportunity to view Patient 9's PHI, which included name, date of birth, medical record number, and diagnostic imaging results.Patient 9 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on March 11, 2013, to her last known address.The California Department of Public Health (CDPH) was notified via a telephone call on March 8, 2013, of the unauthorized access of Patient 9's PHI.The facility policy and procedure titled "Breach of Patient Privacy: Reporting Requirements" dated September 23, 2009, revealed "... Whether the complaint involves the unlawful or unauthorized access to, or the use or disclosure of, a patient's medical information ... the violation will be reported to the patient and State within no more than five (5) calendar days from identification of the unlawful or unauthorized access to, or use or disclosure of the patient's medical information. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280