EISENHOWER MEDICAL CENTER

Report ID: 51EH11.01, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure the unauthorized disclosure of Private Health Information (PHI) for one patient, Patient A. This failure had the potential for the misuse of Patient A's private/medical information.Findings:A telephone investigation was conducted on July 15, 2015, at 10:20 a.m., for the purpose of an entity reported incident. In a concurrent interview with the Legal Counsel (LC), the LC stated on June 22, 2015, the facility was informed by an unintended recipient, the recipient received a fax containing Patient A's PHI. The LC stated the staff responsible for faxing Patient A's PHI, did not follow the facility's policy and procedure to verify the intended recipient prior to the release of a document.The documents faxed to the unintended recipient was reviewed. The document contained the following information:Patient A's name,Patient A's date of birth,Patient A's medical record number,Patient A's home address,Patient A's phone number,Patient A's medical diagnosis, andPatient A's insurance information.The facility's policy and procedure titled "Faxing Protected Health Information" revised date February 10, 2015, indicated "All Protected Health Information sent or received by ...(facility's initials) shall be in a manner that protects against unauthorized disclosure of such to third parties...Sending information...Telephone the receiving facility to inform them that Protected Health Information is being faxed, confirm the fax number...Reconfirm the destination fax number prior to transmission by checking the telephone number displayed on the fax machine before transmitting it..."The facility's policy and procedure titled, "HIPAA- Use and Disclosure of Protected Health Information," dated February 10, 2015, indicated, "To define whether use or disclosure of Protected Health Information (PHI) is required, permitted, or subject to authorization requirements; to provide direction to staff regarding when patient authorization is required for use or disclosure of PHI; and to provide direction to staff regarding when PHI may be used or disclosed without patient authorization."The policy indicated, "It is the policy of...(facility's name), that the confidentiality of Protected Health Information contained in records and collected...will be protected to the fullest extent possible...To protect the patient's right to privacy and confidentiality, at no time will names or information be shared with any person who does not have a need to know in order to provide patient care."The policy defined "Protected Health Information" as, "PHI: Individually identifiable health information transmitted or maintained in any form or medium, including oral, written and electronic. Individually identifiable health information relates to an individual's health status or condition, furnishing health services to an individual or paying or administering health care benefits to an individual. Information is considered PHI where there is a reasonable basis to believe the information can be used to identify an individual."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: F5C711.01