VALLEY CHILDREN'S HOSPITAL

Report ID: 667Y11, California Department of Public Health

Reported Entity: CHILDRENS HOSPITAL CENTRAL CALIFORNIA

Issue:

Based on staff interview, clinical record review and administrative document review the hospital failed to ensure confidentiality of protected health information (PHI) when:1. A Case Manager faxed the Utilization Review Log containing Patient 1-27's PHI to the wrong recipient (CA00342743);2. A Case Manager faxed PHI for Patient 28 to the wrong recipient, in error (CA00342853);3. A Case Manager faxed PHI for Patient 29 to the wrong recipient in error (CA00345244).This failure resulted in unauthorized access to Patient 1-29's PHI and the potential for abuse of that information.Findings:CA003427431. On 2/19/13 at 15:38 p.m. during an interview, the Accreditation Compliance Officer (ACO) Staff 1, stated the utilization review log with Patient 1-27's PHI was faxed in error to a wrong recipient. The error occurred when a case manager was faxing a clinical review form to an insurance company. The utilization review list containing patient 1-27's PHI was also on the fax machine and was inadvertently faxed with the clinical review form. Staff 1 did not check the documents being faxed prior to faxing. The recipient contacted the facility about the error, and shredded the information. Patient 1-27's PHI breached included patient name, type of insurance, admit date, and location of the patients in the hospital.The hospital's policy and procedure number AD-5015 titled "Facsimile Machine" indicated "...All individuals using a facsimile machine to transmit either patient or organizational information will be accountable for ensuring that the information is transmitted to the appropriate destination..."CA003428532. On 2/20/12 at 11:55 a.m. during an interview, the Privacy Officer (PO) stated Patient 28's Discharge Referral was faxed in error to a wrong recipient. The Privacy Officer (PO) stated the case manager transposed the fax number and did not confirm the number prior to faxing the Discharge Referral.Patient 28's PHI breached included patient name, admission date, discharge date, parents name, address, phone numbers, date of birth, diagnosis, treatment while in hospital, discharge plan, medications, medical appointments, and referring physician.The facility policy and procedure number AD-5015 titled "Facsimile Machine"indicated "When confidential information is faxed to a destination number that is not pre-programmed, the fax machine operator shall be responsible to double checking the accuracy of the number in the machine's display before sending the fax."CA003452443. On 3/25/13 at 12:58 p.m. during an interview, the Accreditation Compliance Officer (Staff 1) a breach of Patient 29's PHI was detected on 2/13/13. Staff 1 stated Patient 29's utilization review flow sheet of was faxed in error to a wrong recipient when the Case Manager did not confirm the number before sending the fax.Patient 29's PHI breached included patient name, address, guarantor information, medical record number, account number, date of birth, diagnosis, medications, and treatments.The facility policy and procedure number AD-5015 titled "Facsimile Machine"contained the following documentation: " When confidential information is faxed to a destination number that is not pre-programmed, the fax machine operator shall be responsible for double checking the accuracy of the number in the machine's display before sending the fax".

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights