Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
Adventist Medical Center
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on April 24, 2012. Also cited in 29 other reports.
Report ID: PN2T11, California Department of Public Health
Reported Entity: ADVENTIST MEDICAL CENTER
Issue:
Based on staff interview, facility and administrative document review, the hospital failed to keep Protected Health Information (PHI) confidential when:1. Patient 1's Emergency Room (ER) records were mistakenly faxed to a private business.2. Patient 2's radiology report was mistakenly mailed to a private business.These failures placed the PHI for Patient 1 and Patient 2 at a potential risk for unauthorized use.Findings:Refer to CA003050741. On 4/23/12 at 4:10 p.m., Staff 1 (Privacy Officer) stated on 3/29/12 Staff 2 (Health Information Analyst) mistakenly faxed Patient 1's ER records to a private business.On 4/23/12 at 4:22 p.m., Staff 1 stated the ER records contained Patient 1's name, date of birth, date of service, medical record number, account number, phone number, attending physician, diagnosis, medical history, medication, treatment, vital signs (temperature, pulse, respiration and blood pressure), laboratory results and ultrasound results.The facility policy and procedure number 1000.08.09 titled Confidentiality of Protected Health Information contained the following documentation: "Adventist Health is committed to protecting the privacy and security of protected health information (PHI)...It is the policy to maintain confidentiality for patients and employees at all times and under all circumstances. ...Breach of patient confidentiality through carelessness is when patient information is unintentionally or carelessly accessed, reviewed, or revealed without a legitimate need to know the patient information." The facility's policy and procedure number 1000.03.14, titled "Faxing Patient Protected Health Information contained the following documentation: "It is the sender's responsibility to be aware of the content of the faxes they are sending, to exercise caution in faxing confidential information, and to take precautionary steps to: validate the fax number, key in correct fax number, confirm fax sent to correct fax number, as well as, request is appropriate and meets minimum necessary."Refer to CA003050852. On 4/23/12 at 4:10 p.m., Staff 1 stated on 3/27/12 the facility became aware of a possible privacy breach. The facility's internal investigation revealed on 3/23/12 Patient 2's radiology report was mistakenly mailed to a private business. On 4/23/12 at 4:22 p.m., Staff 1 stated the radiology report contained Patient 2's name, phone number, medical record number and mammography results.The facility policy and procedure number 1000.08.09 titled Confidentiality of Protected Health Information contained the following documentation: "Adventist Health is committed to protecting the privacy and security of protected health information (PHI)...It is the policy to maintain confidentiality for patients and employees at all times and under all circumstances. ...Breach of patient confidentiality through carelessness is when patient information is unintentionally or carelessly accessed, reviewed, or revealed without a legitimate need to know the patient information."
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights