COMMUNITY REGIONAL MEDICAL CENTER

Report ID: DSDJ11.01, California Department of Public Health

Reported Entity: COMMUNITY REGIONAL MEDICAL CENTER

Issue:

Based on staff interview, clinical record and administrative document review, the facility failed to keep Personal Health Information (PHI) confidential when:1. Patient 1's Utilization Review (UR) information was faxed to an incorrect payer. (CA00402571)2. Patients 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, and 12's PHI was inappropriately accessed by a medical doctor without a business need to know. (CA00402038)3. Patient 13 and 14's PHI was sent to another medical facility in error. (CA00402043)These failures caused the breach of Patient 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, and 14's PHI and possible unauthorized use.Findings:CA004025711. On 7/11/14 at 3:35 p.m., during an interview, the Privacy Officer (PO) stated Patient 1's UR information was faxed to the wrong payer. The PO stated the Utilization Review Coordinator was overwhelmed by the volume of reviews to fax, and did not check each fax before sending. Patient 1's PHI breached included: name, date of birth, account number, gender, and clinical findings.The hospital policy and procedure titled "HIPAA General Rules for the Use and Disclosure of PHI" dated 4/18/12, "III. Guidelines: A. Protected Health Information and Records indicated; 1. Protected health information includes any information received, created or maintained by... in which the patient is... identified, regardless of whether the information is in oral, paper or electronic form. B. 2. It is the responsibility of all ... workforce members to comply with policies and procedures... identify... security breaches.CA004020382. On 7/11/14 at 3:38 p.m., during an interview, the PO stated Patients 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, and 12's PHI was accessed on the computer, by MD 1, without business need to know. The PO stated MD 1 should not have accessed any of the patient records because he was not directly involved in the care of these patients.Patients 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, and 12's PHI breached included: name, date of birth, gender, address, and medical record number.The hospital Policy and Procedure titled, "HIPAA General Rules for the Use and Disclosure of PHI" dated 4/18/12 indicated, "The paper and electronic records... which contain PHI, are created and maintained for the purpose of providing patient care..."CA004020433. On 7/11/14 at 3:42 p.m., during an interview, the PO stated an undetermined staff member sent paperwork for Patient 13 and 14 to another medical facility, during transfer of care. The PO stated at the time of the transfer, many people handled the paperwork, and they were unable to determine how this event occurred.Patient 13 and 14's PHI breach included: name, date of birth, gender, address, medical record number, account number, and clinical information.The hospital Policy and Procedure titled "HIPAA General Rules for the Use and Disclosure of PHI" dated 4/18/12, "III. Guidelines: A. Protected Health Information and Records indicated; 1. Protected health information includes any information received, created or maintained by...in which the patient is... identified, regardless of whether the information is in oral, paper or electronic form. B. Hospital privacy policies and procedures: 2. It is the responsibility of all ... workforce members to comply with policies and procedures ... identify ... security breaches.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: UFQ311.01