RIVERSIDE COMMUNITY HOSPITAL

Report ID: 8E8K11, California Department of Public Health

Reported Entity: RIVERSIDE COMMUNITY HOSPITAL

Issue:

Based on staff interview and record review, the facility failed to prevent the unauthorized access and/or disclosure of Patient A's private health information (PHI), when a unit secretary (US) deliberately accessed a discharged patient's record, Patient A, without prior authorization or a request from Patient A or Patient A's responsible party. This had the potential to result in the misuse of Patient A's private health information (PHI).Findings:On August 4, 2015, at 3 p.m., an interview was conducted with the facility's Manager of HIPPA Compliance (MHC) ( HIPPA-Health Insurance Portability and Accountability Act). The MHC stated the 6 South Nursing Unit Secretary (US) accessed a co-worker's electronic medical record when she was a patient on the unit where they both worked. The MHC further stated, the ITD was unable to determine a "foot print" of where in the electronic medical record the US had actually viewed Patient A's specific private health information. The US stated the ITD had a time frame tracking of two minutes viewed by the US. The MHC stated she completed her own investigation and asked the US about why she had accessed the patient (Patient A's) medical record. The MHC stated, at first the US told her she did not access the record. When shown the ITD record of the Unit Secretary's electronic medical record computer access number and the time spent in Patient A's record (the US's electronic footprint), the US then stated she didn't remember looking at the record. The audit trail or computer generated footprint of the Unit Secretary's access to the electronic record verified an uspecified clinical review was done by the US after Patient A was discharged.The MHC verified during the interview that the breach of PHI was committed on June 6, 2015, but the ITD did not do a "footprint" scan until July 13, 2015. The Department and Patient A were notified 15 days later on August 3, 2015. Review of the facility policy titled, "Health Information Management, Minimum Necessary,"effective May 2008, indicated, "Only workforce members with a legitimate "need to know" may access, use or disclose patient information. This includes all activities related to treatment, payment, and healthcare operations of the facility. Each workforce member may access, use or disclose the minimum information necessary to perform his or her designated role regardless of the extent of access provided to him or her..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280