Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
COMMUNITY HOSPITAL OF THE MONTEREY PENINSULA
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on July 12, 2013. Also cited in 24 other reports.
Report ID: ZLT311.01, California Department of Public Health
Reported Entity: COMMUNITY HOSPITAL OF THE MONTEREY PENINSULA
Issue:
Based on interview and record review, the hospital failed to prevent unauthorized access to 6 patients' (Patients 1, 2, 3, 4, 5, and 6) medical information. Findings:On 5/13/13 the California Department of Public Health received a faxed report from the hospital compliance director which indicated the hospital received a request to determine if the electronic medical record of an employee, who was also a patient, had unauthorized access to their medical records. A follow-up report on 5/15/13 indicated six patients' medical records had been accessed without legitimate reasons to do so.During an interview on 7/12/13 at 8:00 a.m., the compliance director stated the hospital determined by review of "User Audit Report" Staff A accessed the medical records of Patients 1, 2, 3, and 4 on 12/19/12 and Patients 3, 5, and 6 on 12/20/12. The compliance director stated Staff A had no business or clinical reason to do so. On 9/11/13, review of the "User Audit Report" provided by the hospital confirmed the patients' records were accessed as reported. During an interview on 7/19/13 at 8:45 a.m., Staff A confirmed he had accessed the medical records of Patients 1, 2, 3, 4, 5, and 6 and stated the information he accessed included the patient's name, date of birth, medical record number, diagnosis and treating physician. Staff A stated in the past as part of his job duties, he had reviewed records of patients not assigned to him but currently such reviews were not part of his assigned job duties. Staff A stated he was not assigned to these patients.Record review on 7/19/13 at 1:30 p.m., of the hospital personnel manual dated 3/2012, indicated, "Everyone is expected to treat patient and hospital information in a respectful, professional, and confidential manner. Such information should never be viewed or discussed with another for reasons of personal interest or for reasons outside the employee's responsibilities."
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280