RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: URBU11, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 7). Patient 7's confidential information was sent via facsimile to a Commercial Business. This resulted in the unauthorized disclosure of Patient 7's protected health information (PHI).Findings:On January 21, 2014, at 1:10 p.m., an interview was conducted with the Administrative Services Officer (ASO). She stated: a. On January 13, 2014, the medical records for Patient 7 were sent to a fax number by Case Management Staff 1 from her office. The facsimile was intended for a Private Medical Group.b. On January 14, 2014, a Commercial Business Manager discovered Patient 7's medical records, with PHI, on the business's facsimile machine and notified Case Management Staff 1. c. The Commercial Business Manager stated he would destroy the 13 page document received by the Commercial Business from the facility.d. Case Management Staff 1 did not send a "test fax" which was the facility's policy prior to sending a document containing PHI.e. The facsimile number provided to the facility by the Private Medical Group was incorrect.The Commercial Business received and had an opportunity to view Patient 7's PHI, which included name, date of birth, medical record number, gender, date of admission, physician's name, address, telephone number, insurance information, health records to include diagnosis, and social security number.Patient 7 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on January 17, 2014, to her last known address. The California Department of Public Health (CDPH) was notified via a telephone call on January 17, 2014, of the unauthorized access of Patient 7's PHI.The facility policy and procedure titled "Facsimile Transmissions" dated October 25, 2012, revealed "... Safeguarding Outbound Transmissions of PHI ... Sending a test fax to any new recipient to confirm that the fax is received prior to transmitting the actual PHI. Reminding entities to provide updated lists of fax number changes. ..."The facility policy and procedure titled "Breach of Patient Privacy: Reporting Requirements" dated September 23, 2009, revealed "... Whether the complaint involves the unlawful or unauthorized access to, or the use or disclosure of, a patient's medical information ... the violation will be reported to the patient and State within no more than five (5) calendar days from identification of the unlawful or unauthorized access to, or use or disclosure of the patient's medical information. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280