Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
RIVERSIDE COUNTY REGIONAL MEDICAL CENTER
Cited by the California Department of Public Health for violations of California’s Health and Safety Code relating to medical privacy during an inspection that began on August 13, 2013. Also cited in 123 other reports.
Report ID: OOXU11.02, California Department of Public Health
Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER
Issue:
Based on interview and document review, the facility failed to prevent the unauthorized access of Patient A's medical information. This had the potential to result in misuse of private information.The facility detected the unauthorized access of Patient A's medical informtion on July 18, 2013, and notified the Department on July 31, 2013, thirteen days later and six days after the mandated timeframe for the facility to report the incident.Findings:On August 13, 2013, an unannounced vist was made to the facility to investigate a facility reported breach of PHI (protected health information). An interview was conducted with the facility's Compliance and Privacy Officer (PO), on August 13, 2013, at 4:40 p.m. The PO stated the breach occurred on July 18, 2013, when the employee made copies of Patient A's medical record to help defend her case. The PO stated the employee who caused the breach was going through a disciplinary action with the facility. A meeting had been scheduled with human resourses. The PO stated that after the HR meeting, the employee folded the copies and put them in her pocket. The radiology employee reviewed Patient A's radiology orders and made copies of the records without permission on July 18, 2013. The HR department reported the incident to the compliance department on July 31, 2013. The facility detected the unauthorized access of Patient A's medical informtion on July 18, 2013, and notified the Department on July 31, 2013, thirteen days later and six days after the mandated timeframe for the facility to report the incident.
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280