EISENHOWER MEDICAL CENTER

Report ID: F6Y911.01, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 7). Patient 7's confidential information was left on an unintended recipient's voice mail system on September 29, 2014, by a facility Registered Nurse (RN). This resulted in the unauthorized disclosure of Patient 7's protected health information (PHI).Findings:On October 10, 2014, at 8:40 a.m., an interview was conducted with the Information Privacy Officer (IPO). He stated: a. On September 29, 2014, facility RN 1 dialed a telephone number, with the intention of calling Patient 7's physician, and left a voice mail message which contained the patient's name and high blood pressure results.b. On September 29, 2014, an unintended recipient, not Patient 7's physician, notified the facility operator that she was in receipt of a voice mail message which involved Patient 7.c. The unintended recipient of the voice mail message, concerning Patient 7, stated the voice mail message had been deleted from her voice mail system.d. RN 1 did not remember if the voice mail system where she left the information concerning Patient 7 was identified with a person's name. The unintended recipient, of a voice mail message, received and listened to information that contained Patient 7's PHI, which included name and current high blood pressure results.Patient 7 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on October 6, 2014, to her last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on October 6, 2014, and a letter dated and mailed on October 6, 2014, of the unauthorized access of Patient 7's PHI. The facility policy and procedure titled, "Information Privacy" reviewed/revised January 2, 2014, revealed, "... (facility name) will take all necessary steps to avoid unauthorized or unlawful access, use or disclosure of protected health information ... Whenever possible, the Information Privacy Officer will contact the individual or organization to whom the information was inappropriately or unlawfully accessed, used or released and requested that no further access, use or disclosure of the information is made and to return or destroy the information. The Information Privacy Officer will contact the Department of Public Health and report the breach within (5) five days of discovery. The Information Privacy Officer will contact the patient within (5) five days of discovery to inform him or her of the unauthorized access, use of disclosure and the plan or step's taken to mitigate it. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: YG4Q11.01