SAN ANTONIO REGIONAL HOSPITAL

Report ID: H9AE11.01, California Department of Public Health

Reported Entity: SAN ANTONIO REGIONAL HOSPITAL

Issue:

Based on interview and record review, the facility failed to ensure the confidential treatment of Patient B's protected health information (PHI) when a Registered Nurse (RN 1) gave Patient B's discharge instruction and prescription documents to Patient A. This resulted in an unauthorized disclosure of Patient B's PHI.Findings:On April 15, 2015 at 2:15 PM, a phone interview was conducted with the Director of Health Information Management (Director of HIM) regarding an entity reported incident of a breach of Patient B's PHI detected by the facility on May 20, 2014. The Director of HIM stated RN 1 handed the discharge instructions and a prescription which contained Patient B's name, age, gender, account number, medical record number, diagnoses, medication names with dosages and instructions, allergies, X-ray procedure names with results, weight, date of birth, and address to Patient A. The Director of HIM stated she did not see a formal letter of notification of the breach to Patient B that would have been sent when the facility investigated this breach but she believed the patient (Patient B) was verbally made aware of the breach on May 20, 2014 while still an inpatient. On May 6, 2015 at 3:15 PM, a phone interview was conducted with RN 1 and the Emergency Room Manager regarding this entity reported incident. RN 1 stated she had two patients being discharged at the same time and she gave discharge instructions and a prescription intended for Patient B to Patient A. RN 1 stated "I didn't double check the documents and handed the patient (Patient A) the wrong documents meant for another patient (Patient B)."RN 1 stated she did not inform Patient B about the breach of his PHI prior to Patient B's discharge. She stated she informed the charge nurse and did not recall if the charge nurse informed Patient B.The charge nurse was not made available to interview. However, an email was received on May 21, 2015 at 8:00 AM, which was sent on May 20, 2015 at 8:18 PM, by the Emergency Room Manager and indicated "I talked with both charge nurses...who were assigned the night of May 20, 2014, the shift in which this HIPPA incident occurred, neither of which has any remembrance of the specific incident."A copy of the letter sent to Patient B, dated May 12, 2015, informing him about the breach of PHI was reviewed and indicated "Our records did not clearly indicate that you had been previously notified".A review of the discharge instruction and prescription documents indicated Patient B's name, age, gender, account number, medical record number, diagnoses, medication names with dosages and instructions, allergies, X-ray procedure names with results, weight, date of birth, and address.A review of the facility's policy and procedure titled, "Confidentiality, Protecting Confidential Information" dated July 2008, indicated "Confidential information must be protected from unauthorized uses, disclosures, inappropriate modification, and / or any action that would prevent it from being readily available to authorized individuals."A review of the facility's policy and procedure titled, "Discharge of Patient: Routine, Leaving Against Medical Advice, Elopement, Patient Who Refuses To Leave The Hospital" dated November 1971 and revised date June 2013, indicated "The patient's nurse will check the completed instructions, prescriptions and other paperwork for proper patient identification, initial each page of the packet and sign, date and time the signature page."The facility failed to ensure the correct discharge instruction and prescription documents were given to Patient A resulting in an unauthorized release of Patient B's PHI.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: OGOV11.01, QDGB11.01