COMMUNITY REGIONAL MEDICAL CENTER

Report ID: K2LW11, California Department of Public Health

Reported Entity: COMMUNITY REGIONAL MEDICAL CENTER

Issue:

Based on staff interview and administrative document review, the hospital failed to keep Protected Health Information (PHI) confidential when:1. Patient 1's medical sticker was affixed to another patient's PHI and sent with the transfer packet to another facility. (refer to CA00387941)2. Patient 3's home medication and personal belongings were given to another patient. (refer to CA00386098)3. Patient 5's PHI was sent with another patient's transfer papers to another facility. (refer to CA00385462)4. Patient 7's PHI was left on a bedside table in a patient room and found by an unauthorized person. (refer to CA00386160)These failures resulted in not protecting the PHI for Patient's 1, 2, 3 and 4 had the potential for unauthorized use. Findings: Refer to CA003879411. On 5/9/14 at 3:40 p.m., during an interview, the Privacy Officer (PO) stated on 2/7/14, Patient 1's medical sticker containing PHI was affixed to Patient 2's PHI and sent with Patient 2's transfer packet to another facility.Review of the medical record indicated the following information was on the medical sticker: Patient name, date of birth, gender, account number, medical record number and date of service. Refer to CA003860982. On 5/9/14 at 3:30 p.m., during an interview, the Privacy Officer (PO) stated on 1/24/14 Patient 3's PHI was breached when personal belongings and home medications were given to Patient 4 by two Registered Nurses (RN's) as Patient 4 was discharged home.Review of the medical record indicated the home medications were labeled with Patient 3's name and the names of the medications. Refer to CA003854623. On 5/9/14 at 3:10 p.m., during an interview, the Privacy Officer (PO) stated on 12/25/13, Patient 5's PHI was attached to Patient 6's transfer packet by a Patient Representative and sent with Patient 6 to another facility. Review of the medical records indicated; Patient 5's PHI was a history and physical which included; patient name, gender, clinical information, psychiatric history, medications and assessment. Refer to CA003861604. On 5/9/14 at 3:40 p.m., during an interview, the Privacy Officer (PO) stated on 1/25/14, Patient 7's medical imaging request containing PHI was left on a bedside table in Patient 8's room by medical imaging staff.Review of the medical record indicated the following information was on the medical imaging request form; Patient name, date of birth, gender, medical record number, x-ray request and date of service. The (Hospital) Policy and Procedure titled, "HIPAA General Rules for the Use and Disclosure of PHI" dated 4/18/12, indicated; "Protected health information includes any information received, created or maintained by ... in which the patient is or may reasonably be identified, regardless of whether the information is in oral, paper or electronic form. It is the responsibility of all ... workforce members to comply with policies and procedures ... to identify and correct problems that may cause privacy and security breaches."

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights