Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
ST MARY MEDICAL CENTER
Cited by the California Department of Public Health for violations of California’s Health and Safety Code relating to medical privacy during an inspection that began on February 6, 2014. Also cited in 55 other reports.
Report ID: 26RF11.01, California Department of Public Health
Reported Entity: ST MARY MEDICAL CENTER
Issue:
Based on interview, and record review, the facility failed to report a breach of protected health information (PHI) within five (5) business days to the California Department of Public Health, Licensing and Certification Unit (CDPH, L&C) as required by the regulation. This failure to report could result in delay in the reporting of future breaches, and resulting patients' PHI to be used in a manner not intended.Findings:An unannounced visit was made to the facility on February 6, 2014 at 1:00 PM, to investigate an entity reported Incident of a breach of PHI for Patient A.During an interview with the Unit Manager for the Telemetry Unit on February 6, 2014 at 1:30 PM, she stated, "The daughter of Patient B reported that the label on her mother's intravenous bag (solution that goes into a vein) had someone else's name on it. After the nurse verified that the solution was what was prescribed for Patient B, she realized she had placed that label on the bag containing Patient A's: name, date of birth, date of admission, medical record number, and physician's name. She replaced the label with the correct one containing Patient B's name. This occurred on December 26, 2013.An interview was conducted with the Director of Accreditation services on February 6, 2014 at 2:00 PM. The Director of Accreditation was asked to explain the delay from the time the breach was detected on December 26, 2014, until the facility notified both Patient A and CDPH (23 business days) she stated, "At first we thought it wasn't a breach because Patients A and B were roommates, so they could easily see what was written on the bag. Then we got a letter in January from Patient A and she complained about the fact her information label had been placed on someone else's IV bag. That is when we sent her the letter and notified CDPH."A review of the facility policy and procedure titled, "Federal Reporting and Notification Requirements Regarding Breaches of Protected health Information," dated July 2013, indicated that the facility was to notify both Patient A and CDPH, L&C within five business days of being made aware a breach had occurred.
Outcome:
Deficiency cited by the California Department of Public Health: HSC Section 1279