LOMA LINDA UNIVERSITY MEDICAL CENTER

Report ID: 8BBY11.01, California Department of Public Health

Reported Entity: LOMA LINDA UNIVERSITY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure the confidential treatment of protected health information (PHI) for one patient (Patient A), when documents containing PHI of Patient A were inadvertently sent to the address of another patient (Patient B). This placed Patient A at risk for identity theft and the unauthorized release of PHI.Findings:On July 28, 2014 at 10:40 AM, a phone interview was conducted with the Compliance Specialist (CS) to investigate an entity reported incident of a breach of PHI for Patient A. The CS stated that an employee (Employee 1) inadvertently sent documents containing PHI of Patient A to the address of Patient B. The documents for Patient A contained PHI which included: Patient A 's name and reason for visit to the facility. During further interview with the CS, the CS stated that documentation containing PHI for Patient A was returned by Patient B, and a written attestation indicating that the information was not retained or further disclosed was received.During a review of letter sent to the California Department of Public Health dated September 12, 2013, the facility indicated on September 9, 2013, the Patient Relations (PR) department inadvertently sent documents containing PHI of patient A to the address of Patient B. The documents for Patient A contained PHI which included: Patient A's name and reason for visit to the facility. Patient A was notified of the breach through a patient notification letter via mail.The facility's policy and procedure, titled "Operating Policy, Patient's Rights, Protection of Patient Privacy," dated May 2013, indicated, "1.1 All medical center employees, members of the medical staff, house staff, volunteers, faculty, and students, shall be responsible for maintaining confidentiality of patient information. This responsibility shall include personal observations, oral conversations, the designated record set and its contents, and any other electronically stored or written patient or patient- related data." The facility 's failure to safeguard the documents containing Patient A's PHI placed Patient A at risk for identity theft and the unauthorized release of PHI.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

4 other violations reported on the same date. Note that other citations may be about the same event: 8Q5M11.01, B26O11.01, IPYQ11.01, N59O11