Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
RIVERSIDE COUNTY REGIONAL MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on January 2, 2014. Also cited in 123 other reports.
Report ID: 2IGV11, California Department of Public Health
Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER
Issue:
Based on interview and record review, the facility failed to prevent unauthorized disclosure of PHI (Protected Health Information) for one patient (Patient 1) when his medical record was provided to a copy service for copying in response to a subpoena for a differnet patient's record (Patient 2). This failed practice resulted in unauthorized persons having access to PHI for Patient 1, and the potential for physical and emotional harm to him and his family, as well as financial harm to him.Findings:During an interview with the facility Compliance and Privacy Officer (CPO) on January 2, 2014, at 11:05 a.m., the CPO stated on November 12, 2013, there were two separate medical records prepared and waiting to be copied in the Medical Records (MR) department. She stated one was the MR for Patient 1, and the other was the MR for Patient 2. She stated both patients had the same first and last name. The CPO stated when the copy service arrived to pick up the MR for Patient 2, the MR staff gave them the MR for Patient 1. The CPO stated neither the facility MR staff or the copy service staff verified the name of the patient.The records for Patient 1 that were provided to the copy service were reviewed on January 2, 2014. The records included the following PHI:1. Name;2. Age;3. Date of birth;4. Medical record number;5. Date of Emergency Department (ED) visit;6. Address;7. Phone number;8. Information regarding next of kin;9. Social security number;10. Chief complaint;11. Physical examination;12. Medication list;13. Treatment provided in the ED; and,14. ED discharge date, instructions, and medications.The copy service employees were not authorized to have access to the MR for Patient 1.
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280