RIVERSIDE COMMUNITY HOSPITAL

Report ID: T8EZ11.01, California Department of Public Health

Reported Entity: RIVERSIDE COMMUNITY HOSPITAL

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 5). Patient 5's confidential information was provided to a Skilled Nursing Facility (SNF) when Patient 4 was discharged from the facility to the SNF on October 8, 2014. This resulted in the unauthorized disclosure of Patient 5's PHI.Findings:On December 9. 2014, at 1:55 p.m., an interview was conducted with the Health Insurance Portability and Accountability Act (HIPAA) Manager. She stated:a. On October 8, 2014, Patient 4 was discharged from the facility to a SNF and the records for Patient 4 were provided to the SNF.b. On October 16, 2014, the SNF informed the facility that with Patient 4's records were documents belonging to another patient (Patient 1). The records belonging to Patient 1 were returned to the facility.c. On December 3, 2014, the Facility Privacy Official (FPO) was reviewing the records returned to the facility by the SNF, and belonging to Patient 1, and discovered a record belonging to Patient 5 in the records for Patient 1.d. The nursing staff did not follow the facility policy and procedure of verifying and signing that all documents, given to the patient/accepting facility, belonged to the patient who was being discharged/transferred.The SNF and Patient 4 received and had an opportunity to view Patient 5's PHI, which included name, medical record number, age, gender, room number, dates of service, and diagnostic laboratory test results.Patient 5 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on December 4, 2014, to her last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on December 4, 2014, and a letter dated and mailed on December 4, 2014, of the unauthorized access of Patient 5's PHI.The facility policy and procedure titled "Safeguarding Protected Health Information" reviewed/revised September 23, 2013, revealed "... Facilities must have a process in place to verify documents are for the correct patient prior to providing the documents to the recipient (e.g. verify recipient and content prior to giving discharge papers to an individual). ..."The facility "Patient Discharge Documentation Final Check" revised July 1, 2014, revealed "... Verify each page of the discharge instructions for the correct patient identification. ... Documentation applies to ALL patients discharged (... or SNF). ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: 2IRT11.01, WZ6R11.01