EISENHOWER MEDICAL CENTER

Report ID: VKO311, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure the unauthorized disclosure of Protected Health Information (PHI) for one patient, Patient 1. This failure had the potential to result in the misuse of Patient 1's private/ medical information.Findings:On September 26, 2014, at 9:10 a.m., a phone investigation was conducted for an entity reported incident. In a concurrent interview with the Deputy General Counsel, Hospital Operations/Compliance (DGOCO), the DGOCO, stated on September 15, 2014, the facility was informed a billing statement intended for Patient 1 was inadvertently mailed to the wrong recipient.The DGOCO, stated an Admitting Staff (AS) electronically entered the incorrect patient guarantor information.The DGOCO, stated all admitting staff had extensive training regarding the electronic entering of patient information, and on the policy and procedure regarding patient's PHI. The DGOCO, stated the AS did not follow the hospital's policy and procedure.The document provided to the unintended recipient, contained the following information;Patient 1's name,Patient 1's address, andPatient 1's medical record /hospital account number.The facility's policy and procedure titled, "HIPAA- Use and Disclosure of Protected Health Information," dated January 2, 2014, indicated, "To define whether use or disclosure of Protected Health Information (PHI) is required, permitted, or subject to authorization requirements; to provide direction to staff regarding when patient authorization is required for use or disclosure of PHI; and to provide direction to staff regarding when PHI may be used or disclosed without patient authorization."The policy indicated, "It is the policy of...(facility's name), that the confidentiality of Protected Health Information contained in records and collected...will be protected to the fullest extent possible...To protect the patient's right to privacy and confidentiality, at no time will names or information be shared with any person who does not have a need to know in order to provide patient care."The policy defined "Protected Health Information" as, "PHI: Individually identifiable health information transmitted or maintained in any form or medium, including oral, written and electronic. Individually identifiable health information relates to an individual's health status or condition, furnishing health services to an individual or paying or administering health care benefits to an individual. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280