Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
SANTA CLARA VALLEY MEDICAL CENTER
Cited by the California Department of Public Health for violations of California’s Health and Safety Code relating to medical privacy during an inspection that began on December 17, 2014. Also cited in 90 other reports.
Report ID: 8WRK11.01, California Department of Public Health
Reported Entity: SANTA CLARA VALLEY MEDICAL CENTER
Issue:
Based on interview and record review, the hospital failed to prevent the unauthorized disclosure of protected health information (PHI) for Patient 1, when Patient 1's re-evaluation form was faxed to the incorrect doctor. The failure resulted in the disclosure of Patient 1's PHI to an unauthorized individual. Findings:The California Department of Public Health received a faxed report on 12/13/13, which indicated on 12/2/13, the hospital received a call from Physician A's (MD A) staff stating MD A's office had received a faxed form for Patient 1 who had not been seen by MD A. The hospital's internal investigation revealed the fax had been sent to the wrong location. The faxed form disclosed Patient 1's name, medical record number, birth date, gender, age, and clinical information.During an interview on 12/17/14 at 11:30 a.m., with the compliance and privacy officer (CPO) and the ethics and compliance officer (ECO), CPO stated the hospital received a notification on 12/2/13 which indicated MD A's office had received a faxed form which belonged to Patient 1, who had not been seen by MD A. ECO confirmed Patient 1's name, medical record number, and diagnosis had been disclosed.During an interview on 1/5/15 at 2:30 p.m., the occupational therapy supervisor (OTS) stated she had been approached by the social worker (SW) who stated she had sent a fax to the incorrect doctor's office (MD A's office). OTS stated SW stated she had received a call from MD A's office stating MD A had received a fax for a patient he had not seen (Patient 1). Review of a copy of a letter sent from the hospital to Patient 1 on 12/13/13, indicated on 12/2/13 a document disclosing Patient 1's name medical record number, birth date, gender, age, and clinical information was incorrectly faxed to MD A's office.Review of a copy of the form which was incorrectly faxed to MD A's office indicated Patient 1's name, medical record number, birth date, diagnosis, medical history, assessment, and other clinical information were disclosed. Review of a copy of the hospital's 10/15/09 "Workforce General Obligations Regarding Uses and Disclosures of Protected Health Information" policy indicated workforce members may disclose PHI for treatment of a patient only if PHI/ePHI is being disclosed to another healthcare provider for the treatment activities of the provider that receives the PHI/ePHI.
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280