RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: PPLD11, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 5). Patient 5's confidential information was facsimiled to the incorrect IPA (Independent Practice Association - an organization comprised of physicians who maintain their independent practices and also join together as an association) by a Case Manager on October 3, 2014. This resulted in the unauthorized disclosure of Patient 5's protected health information (PHI).Findings:On October 10, 2014, at 10:30 a.m., an interview was conducted with the Administrative Services Officer (ASO). She stated: a. On October 3, 2014, Case Manager (CM) 1 facsimiled Patient 5's PHI/medical record to IPA 1.b. On October 3, 2014, at 6:30 p.m., IPA 1 facsimiled back to CM 1/Case Management Department with a note that stated Patient 5 was not one of their insured patients.c. On October 6, 2014, the facsimile was removed from the facsimile machine in the Case Management Department and given to CM 1 with a stack of other facsimiles.d. On October 7, 2014, CM 1 discovered Patient 5's PHI had been facsimiled to the incorrect IPA on October 3, 2014, and notified the Case Management Supervisor.e. On October 9, 2014, she was informed of the unauthorized disclosure of Patient 5's PHI by the Case Management Supervisor.f. Patient 5's information should have been facsimiled to IPA 2, Patient 5's IPA, rather than IPA 1.IPA 1 received and had an opportunity to view Patient 5's PHI, which included name; date of birth; social security number; medical record number; patient number; gender; address; telephone number; mother's maiden name; emergency contact information for an individual; insurance information to include policy numbers; date of service; name of attending physician; diagnosis; and treatment plan. Patient 5 was informed of the disclosure of his protected health information (PHI) via a letter dated and mailed on October 9, 2014, to his last known addresses. The California Department of Public Health (CDPH) was notified via a telephone call on October 9, 2014, of the unauthorized access of Patient 5's PHI.The facility policy and procedure titled "Facsimile Transmissions" reviewed/revised October 25, 2012, revealed "... Employees using fax transmissions of PHI shall implement appropriate safeguards to ensure the delivery to the intended recipient. ... If an errant transmission has compromised a patient's right to privacy, the incident must be reported immediately to the Compliance and Privacy Officer or the designee, or the Patient Safety Officer. ..."The facility policy and procedure titled "Breach of Patient Privacy" dated September 23, 2009, revealed "... Report to the Appropriate Regulatory Agency(ies) ... CDPH, no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by (Facility Name). ... The patient, no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by (Facility Name). ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280