EISENHOWER MEDICAL CENTER

Report ID: L62111, California Department of Public Health

Reported Entity: EISENHOWER MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 1). Patient 1's confidential information was given to Patient 2 following a facility clinic visit on January 8, 2015. This resulted in the unauthorized disclosure of Patient 1's protected health information (PHI).Findings:On January 15, 2015, at 11:20 a.m., an interview was conducted with the Deputy Information Privacy Officer (DIPO). She stated: a. On January 8, 2015, an employee (Licensed Vocational Nurse 1) of a facility clinic gave Patient 2 documents that contained a clinic visit summary.b. On January 8, 2014, Patient 2 left the facility clinic but immediately returned to inform Licensed Vocational Nurse (LVN) 1 that he was in receipt of Patient 1's clinic visit summary.c. Patient 2 returned Patient 1's clinic visit summary to the facility clinic and was given his clinic visit summary.d. LVN 1 had not followed the facility policy and procedure of verifying the correct documents were being given to the correct patient prior to giving Patient 2, Patient 1's clinic visit summary. Patient 2 received and had an opportunity to view Patient 1's PHI, which included name, date of birth, patient identification number, date of service, physician's name, medical history, patient's complaints, medication list, past procedures performed, assessment, and diagnosis.Patient 1 was informed of the disclosure of his protected health information (PHI) via a letter dated and mailed on January 13, 2015, to his last known address.The California Department of Public Health (CDPH) was notified via a facsimile received on January 13, 2015, and a letter dated and mailed on January 13, 2015, of the unauthorized access of Patient 1's PHI.The facility policy and procedure titled "Patient Visit Discharge Process" undated, revealed "At end of each visit, patient will be given discharge instructions/discharge notes/homework created by the physician. ... Prior to handing note to the patient, patient name and DOB (date of birth) will be highlighted to insure correct document given to correct patient. ..."The facility policy and procedure titled "Information Privacy" reviewed/revised January 2, 2014, revealed, "... (facility name) will take all necessary steps to avoid unauthorized or unlawful access, use or disclosure of protected health information ... Whenever possible, the Information Privacy Officer will contact the individual or organization to whom the information was inappropriately or unlawfully accessed, used or released and requested that no further access, use or disclosure of the information is made and to return or destroy the information. The Information Privacy Officer will contact the Department of Public Health and report the breach within (5) five days of discovery. The Information Privacy Officer will contact the patient within (5) five days of discovery to inform him or her of the unauthorized access, use of disclosure and the plan or step's taken to mitigate it. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280