ST MARY MEDICAL CENTER

Report ID: OK5B11.01, California Department of Public Health

Reported Entity: ST MARY MEDICAL CENTER

Issue:

Based on interview, and record review, the facility failed to report a breach(Violation of protected health information) to the California Department of Public Health, Licensing and Certification Unit (CDPH, L&C) and to the parents of two infants (Infant A and Infant B) who had fetal demise,within the five days required by regulation. This failure occurred when two memory cards(chips that go into a camera and record pictures) that contained photographs of two fetal demise, plus an unknown number of live infants' photographs,were discovered to be missing. This had the potential for the infant's pictures that were on the memory card, to be used without authorization, and future breaches to go undetected.Findings:On April 2, 2014 at 9:15 AM, a visit was made to the facility to investigate an entity reported incident that was discovered by the facility on January 16, 2014, but not reported to CDPH, L&C until February 7, 2014, when Infant A was identified, and on February 25, 2014 when the Infant B, the second fetal demise patient was identified.An interview was conducted with the Director of Women and Children's Health on April 2, 2014 at 9:30 AM. She stated, "On January 16, 2014, [used the registered nurse's name- (RN 1)] had received an empty envelope back from an outside agency that provided CD keepsakes for parents with a fetal demise. This agency comes in and photographs babies who have died. Due to their need to use volunteers, a couple of our nurses are cross-trained. [Used RN 1's name] was one of them. When we photographed live infants for identification we used the same camera, but would immediately delete the picture. The fetal demise pictures would be given to the outside agency in a memory card for them to produce the CD for the parents. RN 1 didn't think of it as a breach so didn't say anything, but called the photographer who stated she had sent two memory cards. She identified the one infant (Infant A) who had died, and we contacted their parents. The CD had already been made." The photographer said their was another fetal demise and identified that infant [Infant B]. She told RN 1 there were multiple JPEG's (digital photos) listed when she opened the memory card, but no dates. She opened one, and noted it was a live infant, and closed it again. Fetal demise [Infant A's name used] parents were notified on February 7, 2014, and fetal demise [Infant B'sname used] parents were notified on February 25, 2014."During an interview with the Facility Privacy Officer (FPO) on April 2, 2014 at 9:40 AM, when asked about the delay in notification, she stated stated, "We couldn't figure out who the live babies may have been since the nurses were to delete them from the camera. Once the photographer identified fetal demise two [Infant B], we decided to look up every infant born in the month of November. There were 215 births, so we sent a letter to all the parents, and let them know their infants' picture may have been on the memory card. We had to have some letters translated into different languages, so the last ones were sent March 25, 2014."An interview was conducted by phone with RN 1 on April 2, 2014 at 10:05 AM, and she was asked to describe what happened. She stated, "I received the envelope on January 16th, and it had been torn and was empty. I called the photographer right away, and asked how many memory cards there had been, she told me there had been two. One I had sent with a fetal demise, and one she had picked up at the hospital, and it had a fetal demise. I wasn't thinking that the cards had pictures of live babies, but the other card the photographer picked up at the hospital may have had some pictures." When asked if the nurses kept a log of infant photographs, she stated, "we have one for fetal demises, not live babies." "When I started to think about the other pictures and that they may be of live babies, I told my supervisor."The facility failed to notify the CDPH L&C and the parents of the infants whose photographs were unaccounted for by the facility. The regulation required both CDPH, L&C, and the person or their responsible party, be notified within five business days, to ensure that an investigation is initiated and protected health information does not remain with unauthorized recipients.

Outcome:

Deficiency cited by the California Department of Public Health: HSC Section 1279

Related Reports:

The report containing this deficiency also includes information about 1 other violation. Note that these may be related to the same event: OK5B11.02