RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: IXJD11.01, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure protected health information (PHI) was kept protected, when a written prescription, containing Patient A's name, was given to Patient B. This resulted in the unauthorized disclosure of Patient A's protected health information (PHI) to Patient B and the potential for misuse of the information.Findings:On September 4, 2013, at 1:45 p.m., an interview was conducted with the Compliance and Privacy Officer (CPO) and the Healthcare Administrative Surveyor (HAS). The CPO stated on August 13, 2013, the facility was notified by an outside pharmacy that Patient B was attempting to fill a prescription containing another patient's name and medical record number. The CPO stated Patient B was seen in the Emergency Department was given a prescription with Patient A's information. On September 4, 2013, a copy of Patient A's notification letter was reviewed. The letter indicated "on August 13, 2013...demographic information was inadvertently placed on another patient's prescription. The Demographic information included you full name, medical record number and date of your visit to the Emergency Room."On September 4, 2013, a copy of the prescription was reviewed. The prescription contained Patient A's name and medical record number. The facility policy and procedure titled "Breach of Patient Privacy: Reporting Requirements," dated September 23, 2009, revealed "... Breach: The unauthorized acquisition, access, use, or disclosure of patient protected health information (PHI) that compromises the security or privacy of the PHI...Medical information: any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service..."The facility policy and procedure titled "Patient Identification," with a release date of May 23, 2012, revealed "This Policy and Procedure establishes a standard process to verify patient identity using two unique identifiers, when providing care, treatment, and services." According to the policy, "all healthcare team members will use two unique, patient-specific identifiers...patient full name...patient date of birth..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

3 other violations reported on the same date. Note that other citations may be about the same event: 96CY11.01, KY3P11.01, L4MT11.01