SUTTER COAST HOSPITAL

Report ID: YTMN11.01, California Department of Public Health

Reported Entity: SUTTER COAST HOSPITAL

Issue:

Based on interview and document review, the hospital failed to prevent unauthorized access to one patient's protected health information (PHI).Findings:In interview on 3/6/12 at 11:30 a.m., Staff A stated that he learned on 2/1/12 that on 1/26/12, the itemized bill summary requested by Patient 1 had been mailed to the wrong address. Staff A learned that Patient 1 had paid for the billing summary by credit card, but either Staff B or Staff C in the business office had inadvertently attached Patient 2's credit card receipt to Patient 1's summary, with the result that Patient 1's summary was sent to Patient 2's address. Staff A stated that Patient 2 called on 1/27/12 and reported the error to Staff D. Staff D sent Patient 2 a stamped envelope to send the summary back. Staff A stated that the hospital received the summary in the mail on 2/1/12 and on that date verified that Patient 1's PHI had been breached. Staff A stated that Patient 1 and the Department were notified of the breach on 2/3/12.Document review on 3/6/12 demonstrated that Patient 1's breached PHI consisted of name, date of birth, treatment date, services received, supplies received, and medications received. Document review on 3/6/12 demonstrated that the breach was discovered on 1/27/12 and Patient 1 and the Department were notified on 2/3/12, within 5 business days of discovery.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

6 other violations reported on the same date. Note that other citations may be about the same event: 01ZG11.01, 18ZK11.01, 6P4O11.01, 9M8711.01, N83F11.01, WENM11.01