Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
ST MARY MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on March 29, 2012. Also cited in 55 other reports.
Report ID: 96FR11, California Department of Public Health
Reported Entity: ST MARY MEDICAL CENTER
Issue:
Based on interview and record review, the facility failed to protect Patient A's medical information. This breach caused Patient A's protected health care information to be released.Findings:The facility self-reported that a patient's (Patient A) protected health information (PHI) was inadvertently given to another patient during the registration process. The OR (Operating Room) Procedure Booking Sheet for one patient was given to another patient. During an interview with the health information officer on 6/20/12 at approximately 3:55 PM, she confirmed and stated, "The staff just grabbed the paper (OR Procedure Sheet) without checking and gave it to the patient."Review of the letter mailed to Patient A dated 3/19/12/12 stipulated that a copy of Patient A's surgery booking slip which contained her personal health information was inadvertently handed to another patient. The following healthcare information inadvertently released included: a. Name.b. Medical record number.c. Birth Date.d. Account Number.e. Social Security Number.The policy and procedure titled "Release of Protected Health Information", Origination Date: 1/2012 indicated, it was the facility's requirement, "To obtain a valid authorization form from the patient or the patient's legal representative prior to using or disclosing protected health information (PHI) for purposes that are not related to the patient's treatment, payment ... "The policy also indicated, "The ... (Name) may use and disclose PHI for the purposes other than treatment, payment and its own health care operations after obtaining written authorization from the patient or the patient's legal representative using a compliant authorization form."
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights