EISENHOWER MEDICAL CENTER

Report ID: 01WQ11, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure the unauthorized access of Protected Health Information (PHI) for one patient, Patient 1. This failure had the potential to result in the misuse of Patient 1's private/medical information.Findings:On September 24, 2014, at 10:30 a.m., phone investigation was conducted for an entity reported incident. In a concurrent interview with the facility's Privacy Officer (PO), the PO stated, on September 12, 2014, the facility was informed by Patient 1, that a staff member without authorization, accessed her electronic medical record.The PO stated, the facility's investigation determined an Admitting Staff (AS), accessed Patient 1's electronic medical record ,without authorization on several occasions. The PO stated, the investigation revealed the unauthorized access began in August 2013.The PO stated the facility had a policy and procedure that indicated medical record access was limited to an "on a need to know basis". The PO stated the AS did not follow the facility's policy.A review of the unauthorized accessed documents indicated the following:Patient 1's name,Date of birth,Last four digits of Patient 1's social security number,Address, Drivers license information (to include Patient 1's photograph),State benefits identification card information, andLaboratory tests ordered.The facility's policy and procedure titled, "HIPAA- Use and Disclosure of Protected Health Information," dated January 2, 2014, indicated, "To define whether use or disclosure of Protected Health Information (PHI) is required, permitted, or subject to authorization requirements; to provide direction to staff regarding when patient authorization is required for use or disclosure of PHI; and to provide direction to staff regarding when PHI may be used or disclosed without patient authorization."The policy indicated, "It is the policy of...(facility's name), that the confidentiality of Protected Health Information contained in records and collected...will be protected to the fullest extent possible...To protect the patient's right to privacy and confidentiality, at no time will names or information be shared with any person who does not have a need to know in order to provide patient care."The policy defined "Protected Health Information" as, "PHI: Individually identifiable health information transmitted or maintained in any form or medium, including oral, written and electronic. Individually identifiable health information relates to an individual's health status or condition, furnishing health services to an individual or paying or administering health care benefits to an individual. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual."The facility policy and procedure titled, "Information Privacy,"dated January 2, 2014, indicated, "Unauthorized or Unlawful Access: is the viewing or retrieval of an individual's PHI either electronically or in paper form when this information is for the purpose not relevant to the workforce member's treatment, payment process, or hospital related administrative purposes..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280