EISENHOWER MEDICAL CENTER

Report ID: 31RL11, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 9). Patient 9's confidential information was given to Patient 10 by a physician at one of the facility's clinics on August 15, 2014. This resulted in the unauthorized disclosure of Patient 9's protected health information (PHI).Findings:On August 28, 2014, at 9:25 a.m., an interview was conducted with the Deputy Information Privacy Officer (DIPO). She stated: a. On August 15, 2014, Patient 10 was seen at a facility clinic and the physician gave Patient 10 documents in regards to the care he had received.b. On August 18, 2014, Patient 10 sent an electronic message through the facility's "Relay Health" to the clinic which stated he was in receipt of Laboratory Test Results that did not belong to him and he had found the form in the documents given to him by the physician at the clinic on August 15, 2014. c. Patient 10 stated he was unsure of the patient's name whom the Laboratory Test Results belonged to but he would return the form to the clinic.d. On August 25, 2014, the facility received the returned Laboratory Test Results from Patient 10 and identified the Laboratory Test Results as belonging to Patient 9.e. The facility's clinic physician did not follow the facility's practice for verifying all the documents as belonging to the patient prior to giving documents to Patient 10, on August 15, 2014. Patient 10 received and had an opportunity to view Patient 9's PHI, which included name, identification number, account number, date of birth, address, telephone number, physician's name, diagnosis, and laboratory test results.Patient 9 was informed of the disclosure of his protected health information (PHI) via a letter dated and mailed on August 26, 2014, to his last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on August 25, 2014, and a letter dated and mailed on August 25, 2014, of the unauthorized access of Patient 9's PHI.The facility policy and procedure titled "Information Privacy," reviewed/revised January 2, 2014, revealed "... (facility name) will take all necessary steps to avoid unauthorized or unlawful access, use or disclosure of protected health information ... Whenever possible, the Information Privacy Officer will contact the individual or organization to whom the information was inappropriately or unlawfully accessed, used or released and requested that no further access, use or disclosure of the information is made and to return or destroy the information. The Information Privacy Officer will contact the Department of Public Health and report the breach within (5) five days of discovery. The Information Privacy Officer will contact the patient within (5) five days of discovery to inform him or her of the unauthorized access, use of disclosure and the plan or step's taken to mitigate it. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280