CORONA REGIONAL MEDICAL CENTER

Report ID: BTF411, California Department of Public Health

Reported Entity: CORONA REGIONAL MEDICAL CENTER

Issue:

Based on interview, and record review, the facility failed to ensure Patient A's protected health information (PHI), was not given to another patient. Patient B was given discharge instructions for Patient A. This failed practice resulted in a disclosure/breach of PHI for Patient A.Findings:On August 25, 2011, at 12:30 p.m., an unannounced visit was made to the facility to investigate a breach of PHI for Patient A. On August 25, 2011, at 12:35 p.m., the facility Compliance Officer was interviewed. The Compliance Officer stated the facility received a telephone call from Patient B. Facility staff took discharge instructions from the wrong printer and gave Patient B discharge instructions for Patient A. The instructions contained Patient A's name, date of birth, age, sex, medical record number, account number, and clinical laboratory results. Facility staff failed to thoroughly read the instructions and identify the right patient.On August 25, 2011, the facility policy and procedure titled, PHI Privacy Breach and Unauthorized Access," was reviewed. The policy stipulated, "...This policy supports Corona Regional Medical Center's commitment to assure that all members of the workforce recognize that any compromise of the security or privacy of protected health information will be dealt with equally among all workers..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280