RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: HF7711, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and facility document review, the facility failed to prevent unauthorized access and/or disclosure of Patient A's protected health information (PHI), when copies of Patient A's clinic visit notes were inadvertently mailed to the wrong patient. This failure had the potential to result in misuse of private/protected health information.Findings:On June 17, 2013, at 10 a.m., the Administration Service Officer (ASO), was interviewed. The ASO stated Patient A notified the facility on May 2, 2013, that she had received a copy of her clinic notes from another patient. The ASO stated both patients had requested copies of their clinic visits and the "copy service" personnel inadvertently placed Patient A's information in an envelope with Patient B's address. The ASO stated after Patient B opened the envelope, she placed Patient A's notes in an envelope and sent the documents directly to Patient A. On June 18, 2013, the documents received by Patient B were reviewed. The documents contained Patient A's full name, date of birth, address, phone number, social security number, medical record number and Patient A's health information and medication list. The facility policy titled, "Patient Privacy, Confidentiality, Medical Records, and Access to, or Release or Disclosure of, Patient Information (revised January 2, 2009)," was reviewed. The policy indicated: "Purpose: To protect patients' right to privacy and security of their healthcare information......Personnel shall maintain the confidentiality/privacy of information contained in the medical records of patients and, except for the purposes of treatment, payment, or healthcare operations, shall not disclose patient information without the patient's written authorization......Medical Information: Any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient's medical history, mental or physical condition, or treatment......Individually Identifiable Information: The medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient's name...or other information that, alone or in combination with other publicly available information reveals the individual's identity..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280