SHARP CORONADO HOSPITAL AND HLTHCR CTR

Report ID: DHZW11, California Department of Public Health

Reported Entity: SHARP CORONADO HOSPITAL AND HLTHCR CTR

Issue:

Based on interview, record and document review the hospital failed to ensure that Patient 1's personal and protected health information (PHI) was kept confidential when a Registered Nurse (RN) 1 accessed Patient 1's medical record. RN 1 accessed the hospital's electronic medical record (EMR) without a business purpose or direct medical need. As a result of this failure, RN 1 had direct access to Patient 1's personal and medical information.Findings:An onsite investigation of an entity reported privacy breach was initiated on 5/6/15. It was reported to the California Department of Public Health that, on 3/10/15 an employee had inappropriately accessed Patient 1's medical information without a "business need to know." On 7/7/15 at 2:00 P.M., an interview was conducted with the Director of Quality/Regulatory (DQR). The DQR stated that RN 1 had come to the hospital to retrieve lab results for Patient 1. DQR stated that Patient 1 was never hospitalized there and that the labs were the only information in the EMR. The lab results included Patient 1's: name, medical record number and multiple lab results.On 7/7/15 at 2:35 P.M., an interview was conducted with RN 1. RN 1 stated that she had come to the hospital with Patient 1 to retrieve the lab results so that Patient 1 could start on a specific medication. RN 1 stated that the physician required specific blood work before Patient 1 could take the medication. RN 1 stated that she didn't realize that she had done something wrong since Patient 1 was with her and because Patient 1 was her minor child. A review of RN 1's employee record had revealed that on 4/5/15, RN 1 had training on "Health Information- Access, Use and Disclosure." This training included "verbal requests or approval from your family or friends does not allow (name of hospital) workforce members to access electronic medical records."On 7/7/15 at 3:10 P.M., a second interview and record review was conducted with RN 1. RN 1 reviewed the training she had taken on 4/5/15 that indicated verbal request or approval from your family or friends does not allow (name of hospital) workforce members to access electronic medical records and stated "I'm sure I read that when I did the training in April but guess it didn't stick out that I wasn't allowed when he was standing next to me."A review of the hospital's policy and procedure, entitled "Health Information-Access, use and Disclosure", dated 9/14, indicated "IV. Responsibilities: B. Requests for protected health information should be processed through the Health Information/Medical Records Department whenever possible. In the absence of Health Information/Medical Records personnel, the Department Supervisor, Charge Nurse or designee may respond to request to ensure safety, treatment and continuity of care." This policy was not followed when RN 1 accessed Patient 1's medical record and did not go to the Health Information/Medical Records Department or have a Department supervisor or charge nurse get the information needed for Patient 1.The RN 1's failure to follow the policy and procedure with regards to the access of Patient 1's electronic medical record without a business need to know, resulted in the unauthorized release of Patient 1's protected health record information. This was also in violation of Patient 1's right to confidentiality of all communications and record pertaining to health care received at the hospital.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights