This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.

ST MARY MEDICAL CENTER

18300 HIGHWAY 18 APPLE VALLEY,CA 92307

Cited by the California Department of Public Health for violations of California’s Health and Safety Code relating to medical privacy during an inspection that began on April 2, 2014. Also cited in 55 other reports.


Report ID: OK5B11.02, California Department of Public Health

Reported Entity: ST MARY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to have a system in place to ensure that confidential photographs taken of two fetal demise infants (Infants A and B), and an unknown number of live infants, were secured. This resulted in the potential for the two missing memory cards that contained these photographs, to be used without parental consent.Findings:On April 2, 2014 at 9:15 AM, a visit was made to the facility to investigate an entity reported incident that was discovered on January 16, 2014, that involved two missing memory cards that contained photographs of two fetal demise patients (Infants A and B), and an unknown number of live infant pictures, to come up missing.An interview was conducted with the Director of Women and Children's Health on April 2, 2014 at 9:30 AM. She stated, "On January 16, 2014, [used the registered nurse's name- (RN 1)] had received an empty envelope back from an outside agency that provided CD keepsakes for parents with a fetal demise. This agency comes in and photographs babies who have died. Due to their need to use volunteers, a couple of our nurses are cross-trained. [Used RN 1's name] was one of them. When we photographed live infants for identification we used the same camera, but would immediately delete the picture. The fetal demise pictures would be given to the outside agency in a memory card for them to produce the CD for the parents. RN 1 didn't think of it as a breach so didn't say anything, but called the photographer who stated she had sent two memory cards. She identified the one infant (Infant A) who had died, and we contacted their parents. The CD had already been made." The photographer said their was another fetal demise and identified that infant [Infant B]. She told RN 1 there were multiple JPEG's (digital photos) listed when she opened the memory card, but no dates. She opened one, and noted it was a live infant, and closed it again. Fetal demise [Infant A's name used] parents were notified on February 7, 2014, and fetal demise [Infant B's name used] parents were notified on February 25, 2014."An interview was conducted with the Facility Privacy Officer (FPO) on April 2, 2014 at 9:40 AM. She provided a list of 215 families who had infants born in the month of November 2013. "We decided since we knew when the infant demises were, we would just contact any parent who had an infant born that month,and let them know that their infant's picture may or may not have been on the memory cards."During a phone interview with RN 1 on April 2, 2014 at 10:00 AM, she reported the same series of events as her Director had described. When asked why she didn't notify someone immediately of a possible breach, she stated, "I wasn't thinking about the live baby pictures. I knew the parents already had their CDS made of the fetal demise. After I thought about it, and that there were live babies' pictures, I notified my Director the next day or so."When asked for a copy of the facility's policy and procedure for infant photographing, the Director of Accreditation stated, "We don't have one specifically, we use the Conditions of Admissions." When asked for a policy and procedure for taking fetal demise pictures, given that some of the floor nurses are crossed trained to help [name of agency] she stated, "They work directly with the parents. We don't have a policy." On April 7, 2014, a copy of the Conditions of Admissions was received. The section titled, "Consent to Photograph," listed, "The undersigned hereby consents to be photographed while receiving treatment at the hospital, with the understanding that the images from such photography may be used for the patient's treatment or for peer review, or medical education..." The policy listed under "Maternity Patients," that "If a patient delivers an infant(s) while a patient at this hospital, the undersigned agrees that these same Conditions of Admission" apply to the infant(s)." There was no statement that these photographs could be viewed by anyone outside the facility.A review was conducted on April 7, 2014 at 3:00 PM, of the handout provided by the facility, from the agency which photographs the infants of fetal demise . The consent form specified that the parent signed the following, "I permit the digital images and photographs of my child(ren) to be used by [name of agency] for education purposes, and [agency name] training and marketing. [The agency name] may make additional copies without my prior approval." This did not apply to the live infant photographs contained on the same memory card.The failure to have an established system of accounting for all photographs taken of infants resulted in the facility's inability to identify which infants specifically were at risk for a potential breach of their photographs that were on the missing memory cards.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

Do you believe your privacy has been violated? Here’s what you can do: