DOCTORS MEDICAL CENTER

Report ID: GKG711, California Department of Public Health

Reported Entity: DOCTORS MEDICAL CENTER

Issue:

Based on staff interview, clinical record review, and administrative document review, the hospital failed to ensure confidential treatment of Patient 1-4's protected health information (PHI) when:1. Patient 1's PHI was sent to the wrong provider.2. Patient 2 and Patient 3's PHI was sent to the wrong provider.3. Patient 4's PHI was given to Patient 5 This failure resulted in unauthorized access to Patient 1-4's PHI and the potential for abuse of that information.Findings:CA00415620:1. On 11/14/14 at 2:45 p.m., during a telephone interview, the Privacy Officer (PO) stated that on 9/26/14 a hospital employee (lab technician) tried to input lab tests into the computer for a patient that was not the hospital's patient. The PO stated the employee tried to "work around the system" and in the process entered the wrong provider information. The PO stated the employee should not have tried to bypass the regular system, but did so any way.Patient 1's PHI breached included her name, date of birth, medical record and account number, date of service, and the results of her lab tests.The hospital's policy and procedure titled "Information Privacy and Security Administration Policy" dated 9/16/13, indicated "... [Hospital] Facilities must have appropriate administrative, technical, and physical safeguards to protect the privacy and security of PHI and other confidential information. The safeguards will be designed to reasonably protect PHI and other confidential information from any intentional or unintentional use or disclosure that violates federal and state regulations. [Hospital] will also put in place safeguards to limit incidental uses or disclosures that are made pursuant to permitted or required uses or disclosures."CA004140222. On 11/14/14 at 2:30 p.m., during a telephone interview, the PO stated that on 9/11/14, Hospital Employee 2 (financial services) was provided with an incorrect fax number which was entered into an automatic dialer for the fax machine. The employee sent Patient 2's PHI to the wrong number on 9/11/14 and Patient 3's PHI to the wrong number on 9/12/14. The PO stated that Hospital Employee 3 sent Patient 1's PHI to the same wrong number on 9/16/14. The PO stated the breaches happened because they were given the wrong fax number by the provider and failed to confirm before using it.Patient 2's PHI breached included his name, date of birth, medical record and account number, date of service, address, phone number, and insurance information.Patient 3's PHI included his name, date of birth, medical record and account number, dates of service, address, phone number, insurance information, diagnosis, lab reports, medication list, and doctor's and nurse's notes.The hospital's policy and procedure titled "Transmission of Medical Records by Facsimile" dated 5/16/12, indicated "... Sender Procedure... Verify by telephone the availability of the authorized receiver before beginning transmission... Verify from either the Communication/Transmission Result Report OR [Hospital] Patient Information System Audit Trail; the FAX was sent to the correct phone number."CA004140063. On 11/14/14 at 2:15 p.m., during a telephone interview, the PO stated that on 9/14/14, Hospital Employee 4 (Registered Nurse) gave Patient 4's discharge instructions to Patient 5. The PO stated that the employee should have double checked all of the paper work before giving to Patient 5, but this was not done.Patient 4's PHI breached included her name, date of birth, date of service, physician, diagnosis, and medical record number.The hospital's policy and procedure titled "Information Privacy and Security Administration Policy" dated 9/16/13, indicated "... [Hospital] Facilities must have appropriate administrative, technical, and physical safeguards to protect the privacy and security of PHI and other confidential information. The safeguards will be designed to reasonably protect PHI and other confidential information from any intentional or unintentional use or disclosure that violates federal and state regulations. [Hospital] will also put in place safeguards to limit incidental uses or disclosures that are made pursuant to permitted or required uses or disclosures."

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights