RIVERSIDE COMMUNITY HOSPITAL

Report ID: 2IRT11.01, California Department of Public Health

Reported Entity: RIVERSIDE COMMUNITY HOSPITAL

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 3). Patient 3's confidential information was given to Patient 2 when Patient 2 was discharged from the facility on November 29, 2014. This resulted in the unauthorized disclosure of Patient 3's PHI.Findings:On December 9. 2014, at 3:20 p.m., an interview was conducted with the Health Insurance Portability and Accountability Act (HIPAA) Manager. She stated:a. On November 29, 2014, Patient 2 was discharged from the facility with written discharge instructions provided.b. On December 3, 2014, Patient 2 telephoned the unit manager and informed her she was in receipt of Patient 3's discharge instructions.c. On December 4, 2014, the unit manager informed the Facility Privacy Official of the breach in Patient 3's PHI.d. On December 8, 2014, the facility received back the documents belonging to Patient 3 via the US Mail system.e. Although the documents given to Patient 2, at the time of discharge, on November 29, 2014, had been "double checked" by two Registered Nurses (RNs), RN 1 added the documents belonging to Patient 3, to Patient 2's discharge packet, after the "double check" had been completed.Patient 2 received and had an opportunity to view Patient 3's PHI, which included name, date of birth, gender, medical record number, account number, physician's name, diagnosis, prescription medication given, admit date, and discharge date.Patient 3 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on December 9, 2014, to her last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on December 9, 2014, of the unauthorized access of Patient 3's PHI.The facility policy and procedure titled "Safeguarding Protected Health Information" reviewed/revised September 23, 2013, revealed "... Facilities must have a process in place to verify documents are for the correct patient prior to providing the documents to the recipient (e.g. verify recipient and content prior to giving discharge papers to an individual). ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: T8EZ11.01, WZ6R11.01