EISENHOWER MEDICAL CENTER

Report ID: NDO211.01, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patients' confidential information (Patients 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, and 19). Patient 1 through 19's confidential information was sent to a physicians' billing service through a secured, encrypted electronic portal on various days from September 19, 2014, through January 8, 2015. This was the incorrect physicians' billing service for the care the patients had received. This resulted in the unauthorized disclosure of Patient 1 through 19's protected health information (PHI).Findings:On February 4, 2015, at 11:16 a.m., an interview was conducted with the Information Privacy Officer (IPO). He stated: a. On January 9, 2015, the facility Emergency Department (ED) Administrator received a telephone call from the ED physicians' billing service. The ED physicians' billing service stated they were in receipt, via the electronic portal, of the PHI for Patients 1 through 19 who had not received services in the facility ED on the specific dates listed.b. Patients 1 through 19 had received services at a facility entity, other than the ED, on various days from September 19, 2014, through January 8, 2015.c. The unauthorized disclosure of all 19 patients PHI was discovered on January 9, 2015, by the physicians' billing service.d. On January 9, 2015, the physicians' billing service informed the facility that the PHI for Patients 1 through 19 had been deleted/destroyed.e. The facility determined two Registration Clerks had not been trained appropriately on how to identity the appropriate physician and the appropriate department when coding office visit information.The physicians' billing service received and had an opportunity to view Patient 1 through 19's PHI, which included name; date of birth; medical record number; account number; date of service; social security number; gender; address; telephone number; insurance information to include policy numbers; guarantor's information; diagnosis; and next of kin information.Patients 1 through 19 were informed of the disclosure of their protected health information (PHI) via a letter dated and mailed on January 30, 2015, to their last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on January 30, 2015, and a letter dated and mailed on January 30, 2015, of the unauthorized access of Patient 1 through 19's PHI.The facility policy and procedure titled, "Information Privacy" reviewed/revised January 2, 2014, revealed, "... (facility name) will take all necessary steps to avoid unauthorized or unlawful access, use or disclosure of protected health information ... Whenever possible, the Information Privacy Officer will contact the individual or organization to whom the information was inappropriately or unlawfully accessed, used or released and requested that no further access, use or disclosure of the information is made and to return or destroy the information. The Information Privacy Officer will contact the Department of Public Health and report the breach within (5) five days of discovery. The Information Privacy Officer will contact the patient within (5) five days of discovery to inform him or her of the unauthorized access, use of disclosure and the plan or step's taken to mitigate it. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: IG0Y11.01