HEMET VALLEY MEDICAL CENTER

Report ID: CQRP11, California Department of Public Health

Reported Entity: HEMET VALLEY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure protected health information (PHI) for Patients A and B were sent to the correct office/destination. The facility was notified of a change in a fax number by a case manager that was requesting information for Patients A and B. The PHI was sent to an incorrect fax number and was sent, instead, to an insurance company. This failure resulted in the unauthorized disclosure of PHI to an unintended recipient.Findings:On June 15, 2011, at 2:30 p.m., an unannounced visit was made to the facility to investigate a complaint concerning a breach of PHI.On June 15, 2011, at 3:15 p.m., the Privacy Officer was interviewed via telephone. The Privacy Officer stated the information that was faxed were check lists, which included the registration sheets, history and physicals, consultation reports, discharge planning forms, and continuing reveiw treatment plans. A review of the information disclosed included the patients' names, addresses, age, gender, medical record numbers, diagnoses, admission and discharge dates, and insurance information.On February 21, 2012, the facility policy and procedure titled, "Administrative Safeguards - Security Management Process," was reviewed. The policy indicated, "...Policy. The Hospital will implement a security management process to prevent, detect, contain, and correct security violations..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280