VALLEY CHILDREN'S HOSPITAL

Report ID: KCB611, California Department of Public Health

Reported Entity: CHILDRENS HOSPITAL CENTRAL CALIFORNIA

Issue:

Based on staff interview, clinical and administrative document review, the facility failed to keep Protected Health Information (PHI) confidential when:1. Patient 1's face sheet was given to an ambulance company instead of Patient 2's face sheet. (CA00392272)2. Patient 3's face sheet and history and physical was faxed to a medical equipment company. (CA00392689)3. Patient 4's discharge packet was given to Patient 5's family member. (CA00394075)4. Patient 6's speech-language evaluation was mailed to Patient 7's family member. (CA00394375)5. Patient 8's prescription slip was given to Patient 9's family member. (CA00394064)6. Patient 10, 11, and 12's names and account numbers were faxed to an insurance company rather than being copied. (CA00394558)These failures placed Patient 1, 3, 4, 6, 8, 10, 11, and 12's PHI at a potential risk for unauthorized use.Findings:CA003922721. On 4/18/14 at 9:54 a.m., during an interview, the Privacy Officer (PO) stated Patient 1's face sheet was given to an ambulance company instead of Patient 2's face sheet. She stated the facility Dispatcher did not check all identifiers on the face sheet with the patient prior to giving it to the ambulance personnel. The PHI disclosed included Patient 1's name, birth date, address, telephone number, medical record number, account number, and guarantor's name and social security number.The facility policy and procedure titled, "Confidentiality" dated 8/11, indicated, "Policy. It is the policy of [the facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential... shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from Hospital premises under any circumstances whatsoever, without the prior written consent of Hospital Administration...."CA003926892. On 4/18/14 at 10:02 a.m., during an interview, the Privacy Officer (PO) stated Patient 3's face sheet and history and physical were faxed to a medical equipment company. The PO stated the Case Management Liaison (CM) 1 had two patient information packets at her work station and faxed them both to the medical equipment company. The PO stated the CM 1 did not review all documents prior to sending the fax. The PHI disclosed included Patient 3's name, date of birth, home address, medical record number, account number, and medical diagnosis.The facility policy and procedure titled, "Confidentiality" dated 8/11, indicated, "Policy. It is the policy of [the facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential... shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from Hospital premises under any circumstances whatsoever, without the prior written consent of Hospital Administration...."CA003940753. On 4/18/14 at 10:08 a.m., during an interview, the Privacy Officer (PO) stated an Emergency Department Registered Nurse (RN) 1 gave Patient 4's discharge packet to Patient 5's family member. The PO stated RN 1 did not verify the name on the discharge packet against the name band on Patient 5 as she should have done. The PHI disclosed included Patient 4's name, date of birth, address, telephone number, and medical record number.The facility policy and procedure titled, "Confidentiality" dated 8/11, indicated, "Policy. It is the policy of [the facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential... shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from Hospital premises under any circumstances whatsoever, without the prior written consent of Hospital Administration...."CA003943754. On 4/18/14 at 10:14 a.m., during an interview, the Privacy Officer (PO) stated Patient 6's Speech-Language Evaluation document was sent to Patient 7's family. The PO stated the Speech Pathologist (SP) did not confirm two identifiers for Patient 6 prior to mailing the document. The PHI disclosed included Patient 6's name, birth date, medical record number, account number, and evaluation results.The facility policy and procedure titled, "Confidentiality" dated 8/11, indicated, "Policy. It is the policy of [the facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential... shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from Hospital premises under any circumstances whatsoever, without the prior written consent of Hospital Administration...."CA003940645. On 4/18/14 at 10:21 a.m., during an interview, the Privacy Officer (PO) stated Registered Nurse (RN) 2 gave Patient 8's prescription slip to Patient 9. The PO stated RN 2 failed to verify that all pages of the discharge instructions matched Patient 9's armband. The PHI disclosed included Patient 8's name, birth date, address, telephone number, and medical record number.The facility policy and procedure titled, "Confidentiality" dated 8/11, indicated, "Policy. It is the policy of [the facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential... shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from Hospital premises under any circumstances whatsoever, without the prior written consent of Hospital Administration...."CA003945586. On 4/18/14 at 10:29 a.m., during an interview, the Privacy Officer (PO) stated the Billing Executive Assistant (BEA) attempted to copy a legal document containing the names of Patient 10, Patient 11, and Patient 12. The PO stated the BEA pushed the "fax" button instead of the "copy" button. The PHI disclosed included Patient 10 - 12's name, account numbers, admit dates and discharge dates.The facility policy and procedure titled, "Confidentiality" dated 8/11, indicated, "Policy. It is the policy of [the facility] to respect and protect the privacy rights of patients, their families, employees and third parties. All information that is deemed confidential... shall be kept confidential and shall not be copied, electronically accessed, transmitted or removed from Hospital premises under any circumstances whatsoever, without the prior written consent of Hospital Administration...."

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights