Ukiah Valley Medical Center

Report ID: 80O811, California Department of Public Health

Reported Entity: UKIAH VALLEY MEDICAL CENTER/HOSPITAL D

Issue:

Based on interview and record review, the facility failed to prevent unauthorized access and disclosure of a patient's (Patient 1) protected health information, when some of Patient 1's medical information was handed to Patient 2. This failure allowed the unlawful or unauthorized access to protected health information.Findings:The California Department of Public Health was notified on 2/28/13, that a, "Breach of Protected Health Information (PHI)," occurred on 2/27/13.During an interview on 3/1/13 at 9:15 a.m., Administrative Staff A stated that she received notification from Licensed Staff A, on 2/28/13, that she had handed Patient 2, in error, an Echocardiogram report (in an unmarked envelope) meant for Patient 1. The PHI included: Name, date of birth, medical record number, and results of an Echocardiogram performed on Patient 1. Administrative Staff A also stated that Patient 2 opened the envelope, while still in the facility, and noticed that the name was not his and handed it right back to Licensed Staff B.A review of the facility Policy and Procedure for, "PATIENT RIGHTS RELATED TO PROTECTED HEALTH INFORMATION," (9/2/05), revealed the following: "POLICY SUMMARY/INTENT: The facility is committed to protecting the privacy and security of PHI."The Department verified that Patient 1 was informed of the breach, by mail, on 2/28/13, within the required timeframe's.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280