CORONA REGIONAL MEDICAL CENTER

Report ID: XSIL11, California Department of Public Health

Reported Entity: CORONA REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 3). Two hundred and sixty pages of Patient 3's confidential information was mailed via the US Postal Service to the patient's insurance carrier, in another city, on October 6, 2014. Patient 3's insurance carrier received 11 pages, the facility received 252 pages back because of "damaged property," and 37 pages of Patient 3's PHI were still missing. This resulted in the unauthorized disclosure of Patient 3's protected health information (PHI).Findings:On October 21, 2014, at 2:47 p.m., an interview was conducted with the Chief Nursing Officer (CNO),Director Quality/Patient Safety (DQPS), and Director Health Information Management (DHIM). They stated:a. On October 6, 2014, an employee of the Centralized Business Office (CBO) mailed, via the US Postal Service, the medical record (260 pages) belonging to Patient 3 to the patient's insurance carrier located in another city.b. On October 14, 2014, the facility received back a portion of Patient 3's medical record from the US Postal Service due to "damaged property." The US Postal Service had returned 250 pages of Patient 3's medical record.c. When Patient 3's insurance carrier was contacted by the DHIM, the insurance carrier confirmed they were in receipt of 11 pages of Patient 3's medical record.d. The facility has subsequently received back from the US Postal Service 2 pages of Patient 3's medical record which left 37 pages still missing.The employees of the US Postal Service had an opportunity to view Patient 3's PHI, which included name; date of birth; medical record number; account number; dates of service; gender; address; telephone number; insurance information to include policy numbers; guarantor's information; diagnosis; next of kin information; and the medical record for a five day admission to the facility's Behavioral Health Service.Patient 3 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on October 20, 2014, to her last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on October 20, 2014, of the unauthorized access of Patient 3's PHI.The facility policy and procedure titled "PHI Privacy Breach Notification and Unauthorized Access" reviewed October 7, 2013, revealed "... (Name of Facility) must report any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to CDPH and to the patient no later than five business days after the unlawful or unauthorized access; use or disclosure has been detected by the facility. ... Reports to patients should be made to the affected patient or to the patient's representative ... at his/her last known address. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280