MENIFEE VALLEY MEDICAL CENTER

Report ID: 37IQ11.01, California Department of Public Health

Reported Entity: MENIFEE VALLEY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 3). Patient 3's confidential information was given to Patient 4 when Patient 4 was discharged from the facility's Emergency Department (ED) on September 14, 2014. This resulted in the unauthorized disclosure of Patient 3's PHI.Findings:On September 23, 2014, at 3:12 p.m., an interview was conducted with the Director of Health Information Management (DHIM). She stated: a. On September 14, 2014, Patient 4 was seen, discharged and provided with discharge instructions from the facility ED.b. On September 14, 2014, Patient 4 called the facility's House Supervisor to report she was in receipt of Patient 3's "EDM (Emergency Department Management) Triage Report" which she found in with her discharge instructions.c. The facility was currently attempting to retrieve the "EDM Triage Report" belonging to Patient 3 from Patient 4.d. The Registered Nurse (RN) who provided Patient 4 with her discharge instructions on September 14, 2014, did not verify that all of the documents given to Patient 4, belonged to Patient 4.Patient 4 had an opportunity to view Patient 3's PHI, which included name, date of birth, medical record number, visit identification/account number, gender, date of service, chief complaint, and triage assessment with vital signs.Patient 3 was informed of the disclosure of his protected health information (PHI) via a letter dated and mailed on September 19, 2014, to his last known address.The California Department of Public Health (CDPH) was notified via a facsimile dated and received on September 19, 2014, of the unauthorized access of Patient 3's PHI.The facility policy and procedure titled "Discharge Instructions" revised/reviewed March 2014, revealed "... Verify that documents provided to patients upon discharge pertain to the correct patient. This includes discharge instructions, prescriptions, or any other patient identifiable materials. ..."The facility policy and procedure titled "Breach of PHI - Notification Requirements" reviewed/revised September 2013, revealed "... The Hospital shall report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the nearest regional office of the California Department of Public Health no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ... The Hospital shall also report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the affected patient or the patient's representative at the last known address, no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: O1QJ11.01, WX3C11.01