Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
SANTA CLARA VALLEY MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on October 7, 2014. Also cited in 90 other reports.
Report ID: FQY411.01, California Department of Public Health
Reported Entity: SANTA CLARA VALLEY MEDICAL CENTER
Issue:
Based on interview and record review, the hospital failed to prevent the unauthorized disclosure of patient health information (PHI) for one of one sampled patient (1), when the doctor note for Patient 1's (who is also an employee) was acquired and copied by a hospital coworker. This failure resulted in the intentional disclosure of Patient 1's PHI to an unauthorized individual. Findings:The California Department of Public Health received a faxed report on 3/11/14, which indicated a staff member (xxxxxxx) had acquired a doctor's note which belonged to Patient 1. The note indicated Patient 1's name, date of birth, date of visit, location of visit, and work restrictions had been disclosed. During an interview on 10/7/14 at 2:15 p.m., the ethics and compliance officer (ECO) stated Patient 1 (who is also a hospital staff member) brought in a doctor's note and placed a copy in her supervisor's in-box, which is located in a cabinet in her supervisor's office. ECO stated xxxxxxx had thought the doctor's note was a fake and was upset that her coworker (Patient) did not have to take turns working at the front desk. ECO stated xxxxxxx had thought the note would be evidence, in a grievance, for her union representative since Patient 1 did not have to work at the front desk.During an interview on 10/7/14 at 3:10 p.m., xxxxxxx stated Patient 1 had not been rotating to work at the front desk and refusing other work since 07/2013, because of a change in health status in 05/2013. xxxxxxx stated Patient 1 brought in a doctor's note in 12/2013. xxxxxxx stated another coworker told her to copy the note to show to their union representative, therefore xxxxxxx made a copy of the note. xxxxxxx stated in 02/2014 she put the copy of the note in the shredding bin without showing it to a union representative. xxxxxxx stated the note Patient 1 brought in was in her supervisor's cabinet, leaning up against the side of the cabinet where everyone could read it.A review of a copy of a letter sent on 3/11/14 from the hospital to Patient 1 indicated, on 3/5/14, a supervisor became aware xxxxxxx had acquired a doctor's note belonging to Patient 1. The note indicated Patient 1's name, date of birth, date of visit, location of visit, and work restrictions had been disclosed.A review of a copy of the hospital's 12/27/13 "Workforce General Obligations Regarding Uses and Disclosures of Protected Health Information" policy indicated all workforce members must take reasonable steps to safeguard PHI from any intentional access, use, or disclosure that is in violation of this or any other policy.
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280