Adventist Medical Center

Report ID: Y1OC11, California Department of Public Health

Reported Entity: ADVENTIST MEDICAL CENTER

Issue:

Based on staff interview, facility and administrative document review, the hospital failed to keep Protected Health Information (PHI) confidential when:1. Patient 1's radiology report was mistakenly faxed to the wrong physician.2. Patient 2's radiology report was mistakenly faxed to the wrong physician.3. Patient 3's radiology report was mistakenly faxed to the wrong physician.4. Patient 4's radiology report was mistakenly faxed to the wrong physician.These failures placed the PHI for Patients 1, 2, 3 and 4 at a potential risk for unauthorized use.Findings:Refer to CA00294213 1. On 2/9/12 at 12:35 p.m., Staff 1 (Privacy Officer) stated on 12/12/11 Staff 2 (Registration Clerk) mistakenly faxed Patient 1's radiology report to the wrong physician.On 2/9/12 at 12:42 p.m., Staff 1 stated the radiology report contained Patient 1's name, date of birth, date of service, medical record number, account number, attending physician, diagnosis and chest X-ray results.The facility policy and procedure number 1000.08.09 titled Confidentiality of Protected Health Information contained the following documentation: "Adventist Health is committed to protecting the privacy and security of protected health information (PHI)...It is the policy to maintain confidentiality for patients and employees at all times and under all circumstances. ...Breach of patient confidentiality through carelessness is when patient information is unintentionally or carelessly accessed, reviewed, or revealed without a legitimate need to know the patient information." The facility's policy and procedure number 1000.03.14, titled "Faxing Patient Protected Health Information contained the following documentation: "It is the sender's responsibility to be aware of the content of the faxes they are sending, to exercise caution in faxing confidential information, and to take precautionary steps to: validate the fax number, key in correct fax number, confirm fax sent to correct fax number, as well as, request is appropriate and meets minimum necessary." Refer to CA00295975 2. On 2/9/12 at 12:35 p.m., Staff 1 stated on 1/4/12 the facility became aware of a possible privacy breach. The facility's internal investigation revealed on 12/19/11 Staff 3 (Patient Representative) mistakenly faxed Patient 2's radiology report to the wrong physician.On 2/9/12 at 12:42 p.m., Staff 1 stated the radiology report contained Patient 2's name, date of birth, date of service, medical record number, account number, attending physician, diagnosis and fluoroscopy results.The facility policy and procedure number 1000.08.09 titled Confidentiality of Protected Health Information contained the following documentation: "Adventist Health is committed to protecting the privacy and security of protected health information (PHI)...It is the policy to maintain confidentiality for patients and employees at all times and under all circumstances. ...Breach of patient confidentiality through carelessness is when patient information is unintentionally or carelessly accessed, reviewed, or revealed without a legitimate need to know the patient information." The facility's policy and procedure number 1000.03.14, titled "Faxing Patient Protected Health Information contained the following documentation: "It is the sender's responsibility to be aware of the content of the faxes they are sending, to exercise caution in faxing confidential information, and to take precautionary steps to: validate the fax number, key in correct fax number, confirm fax sent to correct fax number, as well as, request is appropriate and meets minimum necessary."Refer to CA002960673. On 2/9/12 at 12:35 p.m., Staff 1 stated on 1/11/12 the facility became aware of a possible privacy breach. The facility's internal investigation revealed on 1/9/12 Staff 5 (Patient Representative) mistakenly faxed Patient 3's radiology report to the wrong physician.On 2/9/12 at 12:42 p.m., Staff 1 stated the radiology report contained Patient 3's name, date of birth, date of service, medical record number, account number, attending physician, diagnosis and chest X-ray results.The facility policy and procedure number 1000.08.09 titled Confidentiality of Protected Health Information contained the following documentation: "Adventist Health is committed to protecting the privacy and security of protected health information (PHI)...It is the policy to maintain confidentiality for patients and employees at all times and under all circumstances. ...Breach of patient confidentiality through carelessness is when patient information is unintentionally or carelessly accessed, reviewed, or revealed without a legitimate need to know the patient information." The facility's policy and procedure number 1000.03.14, titled "Faxing Patient Protected Health Information contained the following documentation: "It is the sender's responsibility to be aware of the content of the faxes they are sending, to exercise caution in faxing confidential information, and to take precautionary steps to: validate the fax number, key in correct fax number, confirm fax sent to correct fax number, as well as, request is appropriate and meets minimum necessary."Refer to CA00296179.4. On 2/9/12 at 12:35 p.m., Staff 1 stated on 12/29/11 the facility became aware of a possible privacy breach. The facility's internal investigation revealed on 12/28/11 Staff 6 (Patient Representative) mistakenly faxed Patient 4's radiology report to the wrong physician.On 2/9/12 at 12:42 p.m., Staff 1 stated the radiology report contained Patient 4's name, date of birth, date of service, medical record number, account number, attending physician, diagnosis and chest X-ray results.The facility policy and procedure number 1000.08.09 titled Confidentiality of Protected Health Information contained the following documentation: "Adventist Health is committed to protecting the privacy and security of protected health information (PHI)...It is the policy to maintain confidentiality for patients and employees at all times and under all circumstances. ...Breach of patient confidentiality through carelessness is when patient information is unintentionally or carelessly accessed, reviewed, or revealed without a legitimate need to know the patient information." The facility's policy and procedure number 1000.03.14, titled "Faxing Patient Protected Health Information contained the following documentation: "It is the sender's responsibility to be aware of the content of the faxes they are sending, to exercise caution in faxing confidential information, and to take precautionary steps to: validate the fax number, key in correct fax number, confirm fax sent to correct fax number, as well as, request is appropriate and meets minimum necessary."

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights