Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
LOMA LINDA UNIVERSITY MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on July 28, 2014. Also cited in 44 other reports.
Report ID: IPYQ11.01, California Department of Public Health
Reported Entity: LOMA LINDA UNIVERSITY MEDICAL CENTER
Issue:
Based on interview and record review, the facility failed to ensure the confidential treatment of protected health information (PHI) for patient (Patient B), when a medical record staff (Employee 1) mailed Patient A's documents comingled with documents of Patient B. This placed Patient B at risk for identity theft and the unauthorized release of PHI.Findings: A phone interview was conducted with the Compliance Specialists (CS) on July 28, 2014 at 10:30 AM, to investigate an entity reported incident of a breach of PHI for Patient B. The CS stated, on March 6, 2013, Employee 1 mailed documents containing PHI of Patient B that were comingled with documents being mailed for Patient A to an outside agency. Employee 1 did not ensure that the documents being mailed belonged to Patient A. The documents for Patient B included outpatient procedure reports that contained PHI which included: Patient B 's name, age, diagnosis, and clinical notes. The documents for Patient B were returned to the facility. The facility notified Patient B of the breach through a patient notification letter via mail.The facility's policy and procedure, titled, "Operating Policy, Patient 's Rights, Protection of Patient Privacy," dated May 2013, indicated, "1.1 All medical center employees, members of the medical staff, house staff, volunteers, faculty, and students, shall be responsible for maintaining confidentiality of patient information. This responsibility shall include personal observations, oral conversations, the designated record set and its contents, and any other electronically stored or written patient or patient-related data."The facility's failure to safeguard the documents containing Patient B's PHI placed Patient B at risk for identity theft and the unauthorized release of PHI.
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights