HEMET VALLEY MEDICAL CENTER

Report ID: R9BE11, California Department of Public Health

Reported Entity: HEMET VALLEY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure for one patient (Patient A), that her protected health information (PHI) was not disclosed to another facility not authorized to receive the information. This failure resulted in unauthorized access to Patient A's PHI.Findings:An interview was conducted with the Director Of Health Information Management (DHIM) on April 15, 2014, at 3:00 p.m. The DHIM stated on March 31, 2014, a staff member (Staff 1) was making copies of another patient's medical records (Patient B) so that Patient B could be transferred to another facility. Staff 1 mistakenly copied records for Patient A, which contained PHI, and sent Patient A's records in error to the receiving facility of Patient B. Patient A's records were retrieved the following day on April 1, 2014.The DHIM further stated Patient A's PHI disclosed to the other facility included the following information:a. Nameb. Date of birthc. Aged. Sexe. Medical record numberf. Raceg. History and physicalh. Medical diagnosesi. Medicationsj. Laboratory resultsk. X-ray resultsThe facility's policy and procedure titled "HIPAA (Health Insurance Portability And Accountability Act) Privacy," revised September 2013, reflected the facility's policy was to prevent breaches of PHI from occurring, and to respond to suspected or known breaches that do occur.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280