Mercy Medical Center

Report ID: MFRP11.01, California Department of Public Health

Reported Entity: MERCY MEDICAL CENTER

Issue:

Based on staff interview, clinical record and administrative document review, the hospital failed to ensure confidentiality of Protected Health Information (PHI) when Patient 2's medication education sheet was given to Patient 1. This failure resulted in unauthorized access to Patient 2's PHI and the potential for abuse of the PHI.Findings:On 9/5/14 at 2:15 p.m., during an interview, the Privacy Officer (PO) stated on 8/4/14 the privacy office received a letter from Patient 1 stating she had received a copy of Patient 2's medication education sheet. Patient 1 stated she had received the medication education sheet during discharge from the hospital in July. The Licensed Nurse giving the discharge instructions should have verified the name of the patient on the medication instruction sheet before giving the sheet to Patient 1.Patient 2's information breached included: name, date of birth, date of service, medical record number, and medication list.The hospital's policy and procedure number IM-312 titled "Safeguarding of Protected Health Information and Sensitive Information"' dated 12/09. indicated "It is the policy of [Hospital] to comply with state and federal regulation regarding the safeguarding of physical and electronic form of Protected Health Information (PHI). Staff shall provide appropriate access to its information based on a need-to-know basis while preserving its confidentiality and integrity."

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: X6X711.01