This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.

ST MARY MEDICAL CENTER

18300 HIGHWAY 18 APPLE VALLEY,CA 92307

Cited by the California Department of Public Health for violations of California’s Health and Safety Code relating to medical privacy during an inspection that began on April 1, 2014. Also cited in 55 other reports.


Report ID: H5VT11.02, California Department of Public Health

Reported Entity: ST MARY MEDICAL CENTER

Issue:

Based on interview, and record review, the facility failed to ensure that the confidential treatment of protected health information (PHI) for Patient B, when laboratory and radiology imaging results that were to be provided upon discharge from the emergency room (ER) were inadvertently given to Patient A. This resulted in a breach of PHI for Patient B. Findings:On April 1, 2014 at 2:40 PM, an unannounced visit was made to the facility to investigate an entity reported incident of a breach of PHI for Patient B.An interview was conducted with the Director of Accreditation on April 1, 2014 at 2:43 PM, and she was asked to describe the breach of PHI for Patient B. She stated, " On February 6, 2014, Patient A was discharged with the laboratory and imaging results for Patient B. When Patient A went to a follow up appointment at an doctor's office, they noticed that Patient A's paperwork had the wrong name on it (Patient B's name), and returned it to Patient A. Our facility was made aware when that doctor's office faxed a request for Patient A's paperwork and sent a note stating that Patient A had been sent home with a different person's (Patient B's) information. When I called the office to find out whose paperwork that Patient A had received in error, they told me they had given it back to Patient A. I made multiple attempts to reach Patient A to find out who [Patient B] was, because we needed to notify [Patient B] so we could inform them their information had been breached. On March 3, 2014 I sent a certified letter, and on March 6, 2014, Patient A called and voiced a grievance that she had been given the wrong patent's information [Patient B's], and was worried that she may have received the wrong prescription. She was told that she had received everything correctly except for the lab/imaging results."A review of the tests done on Patients A and B on February 6, 2014 indicated the following:a. Patient A had: a chest x-ray, and CT scan of abdomen, EKG (electrocardiogram); complete blood count, chemistry panel and urinalysis.b. Patient B had: CT scan of abdomen and pelvis;complete blood count, chemistry panel, urinalysis and pregnancy test.During a review of the ER records for Patient A and Patient B, on April 1, 2014 at 3:00 PM, the following information was found:a. Patient A was admitted on February 6, 2014 at 4:00 PM, with abdominal pain. Patient A was discharged on February 6, 2014 at 9:18 PM.b. Patient B was admitted on February 6, 2014 at 5:32 PM, with abdominal pain. Patient B was discharged on February 7, 2014 at 12:45 AM (three hours after Patient A).An interview was conducted with the ER Nursing Director on April 1, 2014 at 3:30 PM,to discuss how breach had occurred given that Patient A was discharged three hours before Patient B, and their names, race, and medical record numbers were not similar. The ER Nursing Director stated, "Doctors usually pull up the lab and radiology results on computer but they don't print them. This was not a process problem but a nurse problem. All Patient A's lab work and imaging results were back in time for Patient A's discharge. The nurse didn't check that each page had the correct patient's name and medical record number. This was not a process but a nurse problem. The nurses are expected to check each piece of paper they give to a patient."The nurse's failure to follow facility protocol when discharging Patient A resulted in a breach of PHI for Patient B which included:Patient B's name, date of birth, date of service, medical record number, test results and diagnostic interpretation. This failure to ensure written instructions were provided to the right Patient (Patient A),resulted in an unauthorized release of Patient B's PHI.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

Do you believe your privacy has been violated? Here’s what you can do: