Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
KAISER FOUNDATION HOSP SO SACRAMENTO
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on September 16, 2014. Also cited in 16 other reports.
Report ID: N0Z211.01, California Department of Public Health
Reported Entity: KAISER FOUNDATION HOSP SO SACRAMENTO
Issue:
Based on staff interview, facility document review, and facility Policy and Procedure review, the facility failed to ensure unauthorized access to Patient 1's Protected Health Information (PHI) when medical information was faxed to a State Agency. This failure placed Patient 1 at risk of compromised health information of a sensitive nature.Findings:On 8/24/14 Patient 1's PHI was intended to be faxed to a medical equipment supply company, but was faxed to a State Agency. On 8/25/14 the facility was notified by the State Agency of the misdirected fax of PHI. The facilities Compliance Department was notified by email on 8/26/14.The following information was faxed to the wrong number:1. Patient 1's name;2. Address;3. Date of birth;4. Medical record number;5. General history;6. Description of Patient 1's medical condition.Facility Policy and Procedure titled "Information Security Policy", dated August 2012, indicated the following: "Fax Back: 10.3.3.2 Verify fax numbers before sending non public information assure the numbers are correct for the intended addresses and to assure the receiving fax machines are either in secure, non-public areas or that the intended recipients or their designees are the fax machines awaiting the fax messages."In an interview with the Compliance Program Manager (CPM), on 9/16/14, at 2:46 p.m., CPM stated they were not sure where staff got the fax number from, and it was documented in several locations as the right fax number. CPM stated the State Agency contacted the facility to inform them they had received PHI and would destroy the documents. CPM stated the the information was supposed to be faxed to a durable medical equipment company. All involved Employees were counseled and had formal coaching.
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280