Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
SAINT AGNES MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on March 2, 2015. Also cited in 16 other reports.
Report ID: MDU911, California Department of Public Health
Reported Entity: SAINT AGNES MEDICAL CENTER
Issue:
Based on staff interview and administrative document review, the hospital failed to keep Protected Health Information (PHI) confidential when:1. Patient (Pt) 1 was given the radiology (X-ray pictures of the inside of the body) reports for Pt 2 and Pt 32. Pt 2 was given the radiology report for Pt 1 This failure resulted in unauthorized access to Pt 1, Pt 2, and Pt 3's PHI and the potential for unauthorized use. FINDINGSOn 3/2/15 at 3:45 p.m., during an interview, the Privacy Officer (PO) stated the Radiology Admin Technician (RT) put Pt 2 and Pt 3's radiology (X-ray pictures of the inside of the body) reports in an envelope with Pt 1's radiology film and Pt 1's radiology report in an envelope with Pt 2's radiology film. The RT failed to check the reports prior to matching them to the films. The RT placed the names of the patients on the front of the envelopes containing the radiology films and reports and sent the envelopes to Medical Records for the patients to pick them up. Patient (Pt) 1 was given the radiology reports for Pt 2 and Pt 3. Pt 2 was given the radiology report for Pt 1. The PO stated breached Protected Health Information (PHI) included the reason for the x-ray; the type of x-ray; the findings of the x-ray; and the physician's impression of the x-ray. All radiology reports were returned. Letters were sent to all the patients whose PHI was breached. The facility policy and procedure titled, "Privacy and Confidentiality Policy" dated 9/14 indicated, "[The facility] requires all colleagues and affiliates to maintain confidentiality of patient...confidential information...All forms of communication of private and confidential patient ...information should be provided only to those with a need to know..."
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights