EISENHOWER MEDICAL CENTER

Report ID: FJJC11, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 3). Patient 3's confidential information was accessed through the electronic medical record by an unauthorized physician's office employee on August 12, 13, 14, and 15, 2014. This resulted in the unauthorized disclosure of Patient 3's protected health information (PHI).Findings:On August 25, 2014, at 11:35 a.m., an interview was conducted with the Information Privacy Officer (IPO). He stated: a. On August 15, 2014, a nurse caring for Patient 3 became concerned when a family member (unauthorized physician's office employee) for Patient 3 provided information which could only have been obtained from Patient 3's electronic medical record.b. On August 15, 2014, the nurse reported her concerns to her Nursing Director who informed the IPO.c. The facility investigation revealed: - The unauthorized physician did not provide care to Patient 3;- The unauthorized physician's office employee had electronically, remotely accessed Patient 3's record on August 12, 13, 14, and 15, 2014;- The unauthorized physician's office employee was one of Patient 3's family members; and- There was no indication Patient 3 had ever given access or the family member had ever requested access to Patient 3's record.d. On January 7, 2014, the facility had given the unauthorized physician's office employee access to patients medical records as an employee of the physician (a member of the facility medical staff) in order to coordinator the care of the physician's patients seen at the facility.The "(Facility Name) Information Systems Access Authorization Form for Medical Office Staff" dated January 7, 2014, indicated "... provides Medical Office Staff with access to patient results (lab and radiology), ED reports and Transcription, and to Horizon Patient Folder (HPF). I certify that I have a confidentiality and security agreement with my staff and I agree to hold members of my staff responsible for appropriate access to patient information." The form listed the unauthorized physician's office employee and was signed by the physician.The "Patient Access Audit Report" indicated the unauthorized physician's office employee accessed the record of Patient 3 on: - August 12, 2014, at 8:15 a.m., for 10 minutes to view orders and results; - August 12, 2014, at 3:32 p.m., for 15 minutes to view orders and results;- August 13, 2014, at 8:05 a.m., for 12 minutes to view orders and results;- August 14, 2014, at 8:20 a.m., for less than one minute to view orders and results; and- August 15, 2014, at 8:09 a.m., for 41 minutes to view orders and results.The unauthorized physician's office employee accessed and viewed Patient 3's PHI, which included name, date of birth, medical record number, gender, dates of examinations, physicians' names, examination results, physician's orders and laboratory results.Patient 3 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on August 22, 2014, to her last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on August 22, 2014, and a letter dated and mailed on August 22, 2014, of the unauthorized access of Patient 3's PHI.The facility policy and procedure titled, "Remote System Access" reviewed/revised March 14, 2014, revealed "... Physician and Physician Office Access: Physicians and their staff can access their patient information through the Physician Portal using an RSA SecurID device upon request by the Physician. ... It is the responsibility of the physician to ensure that any of their staff adhere to any privacy or security regulations. The facility policy and procedure titled, "Information Privacy" reviewed/revised January 2, 2014, revealed, "... (facility name) will take all necessary steps to avoid unauthorized or unlawful access, use or disclosure of protected health information ... Whenever possible, the Information Privacy Officer will contact the individual or organization to whom the information was inappropriately or unlawfully accessed, used or released and requested that no further access, use or disclosure of the information is made and to return or destroy the information. The Information Privacy Officer will contact the Department of Public Health and report the breach within (5) five days of discovery. The Information Privacy Officer will contact the patient within (5) five days of discovery to inform him or her of the unauthorized access, use of disclosure and the plan or step's taken to mitigate it. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280