KAISER FOUNDATION HOSPITAL-MORENO VALLEY

Report ID: HJCI11, California Department of Public Health

Reported Entity: KAISER FOUNDATION HOSPITAL-MORENO VALLEY

Issue:

Based on interview and record review, the facility failed to prevent the unauthorized access of Patient 1's medical information. This had the potential to result in misuse of private information.Findings:On February 27, 2013, at 8:30 a.m., an investigation was conducted for an entity reported incident. On February 27, 2013, at 8:50 a.m., the Compliance Officer (CO), Compliance Project Manager (CPM), Director of Accreditation/Licensure and Regulatory Affairs (DA), and Chief Operating Officer (COO) were interviewed. The CPM stated on February 7, 2013, Patient 1's record was accessed by an Emergency Department Registered Nurse (RN 1). The CPM stated RN 1 accessed Patient 1's record because RN 1 wanted to see what Patient 1 "looked like." The CPM stated RN 1 wanted to know because her son, "...was in law enforcement...she (RN 1) was concerned..." The CPM stated RN 1 had no business or medical reason to access Patient 1's record.On March 12, 2013, at 9:15 a.m., a facility document titled, "Users Accessing a Patients EMR (electronic medical record) using PAT_ID" was reviewed with the CO and CPM. The CPM stated the document indicated RN 1 accessed Patient 1's record on February 7, 2013, at 9:57 a.m. The document indicated RN 1 accessed Patient 1's "demographics" section. The CPM stated there was no medical information accessed in Patient 1's record. The CPM stated the "demographics" contained Patient 1's name, address, date of birth, and medical record number.The facility policy titled, "Mitigation of Impermissible Uses and Disclosure of Protected Health Information" revised on January 2012, was reviewed. The policy indicated, "Kaiser Permanente (KP) must take action to reduce or eliminate, to the extent feasible, any known harm caused by an impermissible use or disclosure of Protected Health Information (PHI) by KP or its business associates."The policy further indicated, "Protected Health Information (PHI) - Individually identifiable health information including demographic information...created or obtained by a covered entity that is related to an Individual's past, present, or future physical or mental health or condition, including the provision of his/her health care..." The policy further indicated, "...Individually identifiable means that the information either identifies the Individual or there is a reasonable basis to believe that the information can be used to identify the Individual, such as name, date of birth, address...other personal identifiers..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280