HEMET VALLEY MEDICAL CENTER

Report ID: DUKC11, California Department of Public Health

Reported Entity: HEMET VALLEY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 3). Patient 3's confidential information was facsimiled to a Private Non-Healthcare Business, by the Emergency Department (ED) Case Manager, on October 3, 2014. This resulted in the unauthorized disclosure of Patient 3's PHI.Findings:On October 13, 2014, at 4 p.m., an interview was conducted with the Director Health Information Management (DHIM). She stated: a. On October 3, 2014, Patient 3 was seen in the facility ED and was to be discharged home with home healthcare services.b. On October 3, 2014, the ED Case Manager (CM) facsimiled Patient 3's face sheet, respiratory assessment, and the physician's referral for home healthcare services.c. On October 3, 2014, the ED CM received a telephone call from a Private Non-Healthcare Business informing her they were in receipt of Patient 3's PHI.d. The Private Non-Healthcare Business stated they had shredded Patient 3's PHI.e. The facsimile numbers were the same except for the last digit of the number with the correct number being an eight and the incorrect number being a three.f. The ED CM had not followed the facility's policy and procedure of verifying that the correct facsimile number had been inputted prior to pushing the send button.Employees of the Private Non-Healthcare Business had an opportunity to view Patient 5's PHI, which included name, date of birth, social security number, medical record number, visit identification/account number, gender, date of service, address, telephone number, insurance information to include account numbers, emergency contact's information, physician's name, respiratory assessments, certification of medical necessity, and follow-up home care needs.Patient 3 was informed of the disclosure of his protected health information (PHI) via a letter dated and mailed on October 10, 2014, to his last known address.The California Department of Public Health (CDPH) was notified via a facsimile dated and received on October 10, 2014, of the unauthorized access of Patient 3's PHI.The facility policy and procedure titled "Breach of PHI - Notification Requirements" reviewed/revised September 2013, revealed "... The Hospital shall report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the nearest regional office of the California Department of Public Health no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ... The Hospital shall also report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the affected patient or the patient's representative at the last known address, no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280