HEMET VALLEY MEDICAL CENTER

Report ID: E91W11, California Department of Public Health

Reported Entity: HEMET VALLEY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 3). Patient 3's confidential information was given to Patient 4, with her discharge instructions, when Patient 4 was discharged from the Emergency Department (ED) on December 30, 2013. This resulted in the unauthorized disclosure of Patient 3's PHI.Findings:On January 8, 2014, at 8:45 a.m., an interview was conducted with the Director of Health Information Management (DHIM). She stated: a. On December 30, 2013, Patient 4 was seen and discharged from the facility ED.b. On January 3, 2014, Patient 4 called a facility Information Specialist stating her discharge instructions, from the ED visit on December 30, 2013, contained Patient 3's information.b. On January 3, 2014, Patient 4 returned the discharge instructions with Patient 3's PHI to the facility Health Information Management (HIM) Department.Patient 4 had an opportunity to view Patient 3's PHI, which included name, date of birth, medical record number, visit identification/account number, and care provider's name.Patient 3 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on January 3, 2014, to her last known address.The California Department of Public Health (CDPH) was notified via a facsimile dated January 3, 2014, and received January 6, 2014, of the unauthorized access of Patient 3's PHI.The facility policy and procedure titled "Discharge Instructions" revised/reviewed August 2013, revealed "... Verify that documents provided to patients upon discharge pertain to the correct patient. This includes discharge instructions, prescriptions, or any other patient identifiable materials. ..."The facility policy and procedure titled "Breach of PHI - Notification Requirements" reviewed/revised September 2013, revealed "... The Hospital shall report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the nearest regional office of the California Department of Public Health no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ... The Hospital shall also report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the affected patient or the patient's representative at the last known address, no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280