STANFORD HOSPITAL

Report ID: TQ4N11, California Department of Public Health

Reported Entity: STANFORD HOSPITAL

Issue:

Based on interview and record review, the hospital failed to prevent unauthorized access to one patient's (Patient 1) medical information. Findings:On 5/22/13, the California Department of Public Health received a faxed report from the hospital chief privacy officer which indicated the hospital identified unauthorized access to Patient 1's health information.During an interview on 7/30/13 at 11:00 a.m., the privacy director stated the hospital was informed on 5/20/13, a backpack which contained 27 pages of Patient 1's medical record was stolen from Physician A's car while it was parked near his home.Record review on 8/1/13 at 9:30 a.m. indicated Physician A had completed annual privacy training on 5/15/12 and 5/19/13. Record review of the annual Graduate Medical Education policy indicated "DO NOT leave patient information or devices containing patient information in a car, a car truck, an unlocked room, or any other area unattended (not even for a few minutes)."During an interview on 8/14/13 at 8:10 a.m., Physician A stated he brought pages of Patient's 1 clinical record to present the case before a group of physicians. Physician A stated instead of his usual practice of returning the record to the hospital, he placed them in his backpack which was stolen from his car between midnight and 6:00 a.m. the next day. Physician A stated the information included Patient 1's name, date of birth, medical record number, address and telephone number, insurance information, medical history, treating physician and plan of care. Physician A stated as soon as he was aware of the missing backpack, he contacted the hospital and filed a police report.

Outcome:

Fine imposed and deficiency cited by the California Department of Public Health: Health & Safety Code 1280