Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
SONOMA VALLEY HOSPITAL
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on January 31, 2012. Also cited in 10 other reports.
Report ID: GDFR11, California Department of Public Health
Reported Entity: SONOMA VALLEY HOSPITAL
Issue:
Based on interview and document review, the hospital failed to prevent unauthorized access to two patients protected health information.Findings:In interview in 01/31/12 at 12 p.m., Staff A stated that copies of a patient's records had been requested, and Staff B copied the records and set them aside in the basket where records for pick-up are kept. When the requestor came in on 01/16/12, Staff B picked up the entire pile of papers in the basket without realizing that two other patients' records were at the bottom of the stack. The requestor called later in the day to inform Staff C that the records of Patient 1 and Patient 2 had been included in the records. The requestor brought their records back to the hospital. Staff A stated that Patient 1, Patient 2, and the Department were notified of the breaches on 01/19/12.In interview on 01/31/12 at 12:30 p.m., Staff B stated that she had picked up the whole pile of records and placed them in an envelope without checking to see if all of the records were those of the intended recipient.Document review on 01/31/12 demonstrated that Patient 1's breached protected health information consisted of name, date of birth, sex, medical record number, medical history, tests performed, test results, and ordering physician. Patient 2's breached protected health information consisted of name, age, medical record number, medical history, treatments, hospital course and dates, medications, and treating physicians.Document review on 01/31/12 confirmed that Patient 1, Patient 2, and the Department were notified of the breaches on 01/19/12, within 5 business days of discovery of the error.
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280