This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.



Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on January 28, 2014. Also cited in 123 other reports.

Report ID: XWPC11.01, California Department of Public Health



Based on interview and record review, the facility failed to prevent the unauthorized access and/or disclosure of Patient B's medical information. This had the potential to result in misuse of private information.Findings:On January 28, 2014, at 8:30 a.m., an investigation was conducted for an entity reported incident. On January 28, 2014, at 3:15 p.m., the Administrative Services Officer (ASO) was interviewed. The ASO stated Patient A came in the Emergency Department (ED) on August 4, 2013. In the ED, the facility placed an identification armband with Patient B's information (same name; but with a different date of birth, medical record number, and patient number). Patient A subsequently received the Conditions of Admission (COA) document with Patient B's information. The COA, received by Patient A, was reviewed with the ASO. The document contained Patient B's name, date of birth, medical record number, and patient number. In a concurrent interview, the ASO stated the registration clerk did not use 2-patient identifier prior to applying the identification armband. The facility policy titled, "Patient Privacy, Confidentiality, Medical Records, and Access to, or Release or Disclosure of, Patient Information (revised March 16, 2013)" was reviewed. The policy indicated: "Purpose: To protect patients' right to privacy and security of their healthcare information......Personnel shall maintain the confidentiality/privacy of information contained in the medical records of patients and, except for the purposes of treatment, payment, or healthcare operations, shall not disclose patient information without the patient's written authorization......Medical Information: Any individually identifiable information, in electronic or physical form, in possession of or derived from a provider of health care, health care service plan, pharmaceutical company, or contractor regarding a patient's medical history, mental or physical condition, or treatment......Individually Identifiable Information: The medical information includes or contains any element of personal identifying information sufficient to allow identification of the individual, such as the patient's name...or other information that, alone or in combination with other publicly available information reveals the individual's identity..."


Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

Do you believe your privacy has been violated? Here’s what you can do: