ADVENTIST MEDICAL CENTER - REEDLEY

Report ID: EG2Q11, California Department of Public Health

Reported Entity: ADVENTIST MEDICAL CENTER - REEDLEY

Issue:

Based on staff interview and administrative document review, the facility failed to keep Protected Health Information (PHI) confidential when Staff 2 accessed Patient 1's PHI with no business need to know. This failure placed Patient 1's PHI at a potential risk for unauthorized use.Findings:On 12/6/11 Staff 1 (Privacy Officer) stated on 9/24/11 the facility became aware of a possible privacy breach. The facility's internal investigation revealed, on 9/23/11 Staff 3 (Physician) called Staff 2 (Unit Clerk) asking for Patient 1's telephone number. Staff 2 accessed Patient 1's medical record, obtained her phone number and gave it to Staff 3. Staff 1 stated Staff 3 then called Patient 1 and spoke to her in a loud voice regarding a letter sent by Patient 1. Staff 1 stated it was the facility's policy to only access a patient's PHI on a business need-to-know basis only. Staff 1 stated Staff 2 and Staff 3 had no business need-to-know. Facility policy and procedure number 1000.08.09 titled "Confidentiality of Protected Health Information" contained the following documentation: It is the policy to maintain confidentiality for patients at all times and under all circumstances. Persons who receive or view information about patient matters in order to do their jobs may not share the information with any others unless the others need to know that information by virtue of their job requirements.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights