EISENHOWER MEDICAL CENTER

Report ID: 6KOC11.01, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure the unauthorized disclosure/release of Protected Health Information (PHI) for one patient (Patient A). Patient A's laboratory report was faxed to an unintended recipient. This failure had the potential to result in the misuse of Patient 1's private/medical information.Findings:A telephone investigation was conducted on March 19, 2015, at, 8:45 a.m., for the purpose of an entity reported incident. In a concurrent interview with the Deputy Information Privacy Officer (DIPO), the DIPO stated on February 18, 2015, the facility was informed by an unintended recipient, the recipient received a fax containing Patient A's laboratory report. The DIPO stated the staff responsible for faxing Patient A's laboratory report, did not follow the facility's policy and procedure to verify the fax number prior to the release of a document.The document faxed to the unintended recipient was reviewed. The document contained the following information:Patient A's name,Patient A's date of birth/sex,Patient A's medical record number,The name of Patient A's physician, andThe laboratory test result.The facility's policy and procedure titled "Faxing Protected Health Information" undated, indicated "All Protected Health Information sent or received by ...(facility's initials) shall be in a manner that protects against unauthorized disclosure of such to third parties...Sending information...Telephone the receiving facility to inform them that Protected Health Information is being faxed, confirm the fax number...Reconfirm the destination fax number prior to transmission by checking the telephone number displayed on the fax machine before transmitting it...The facility's policy and procedure titled, "HIPAA- Use and Disclosure of Protected Health Information," dated January 2, 2014, indicated, "To define whether use or disclosure of Protected Health Information (PHI) is required, permitted, or subject to authorization requirements; to provide direction to staff regarding when patient authorization is required for use or disclosure of PHI; and to provide direction to staff regarding when PHI may be used or disclosed without patient authorization."The policy indicated, "It is the policy of...(facility's name), that the confidentiality of Protected Health Information contained in records and collected...will be protected to the fullest extent possible...To protect the patient's right to privacy and confidentiality, at no time will names or information be shared with any person who does not have a need to know in order to provide patient care."The policy defined "Protected Health Information" as, "PHI: Individually identifiable health information transmitted or maintained in any form or medium, including oral, written and electronic. Individually identifiable health information relates to an individual's health status or condition, furnishing health services to an individual or paying or administering health care benefits to an individual. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: NVRK11.01, T61D11.01