RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: TUYI11.01, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patients' confidential information (Patients 6, 7, 8, and 9). Patient 6's, 7's, 8's, and 9's confidential information was faxed inadvertently to the facility Purchasing Department on July 20, 2013. This resulted in the unauthorized disclosure of Patient 6's, 7's, 8's, and 9's protected health information (PHI).Findings:On August 19, 2013, at 2:45 p.m., an interview was conducted with the Compliance and Privacy Officer (CPO) and the Healthcare Administrative Surveyor (HAS). The CPO stated: a. On July 20, 2013, the Pediatric Department inadvertently faxed the "Traylist" to the Purchasing Department rather than Nutritional Services.b. On July 22, 2013, an individual from the Purchasing Department informed the Pediatric Manager that they were in receipt of the Pediatric Department "Traylist" for July 20, 2013.c. The Pediatric Manager retrieved the "Traylist" from the Purchasing Department and verified the "Traylist" was faxed to xx1x rather than xx7x.The Purchasing Department staff received and had an opportunity to view Patient 6's, 7's, 8's, and 9's PHI, which included name, age, date of birth, medical record number, and diet order. The responsible partys' for Patients 6, 7, and 8 were informed of the disclosure of their minor child's protected health information (PHI) via a letter dated and mailed on July 26, 2013, to their last known addresses. Patient 9's responsible party was unable to be informed because the facility was provided an incomplete address in another country.The California Department of Public Health (CDPH) was notified via a telephone call on July 26, 2013, of the unauthorized access of Patient 3's and Patient 3's mother's PHI.The facility policy and procedure titled "Breach of Patient Privacy: Reporting Requirements" dated September 23, 2009, revealed "... Whether the complaint involves the unlawful or unauthorized access to, or the use or disclosure of, a patient's medical information ... the violation will be reported to the patient and State within no more than five (5) calendar days from identification of the unlawful or unauthorized access to, or use or disclosure of the patient's medical information. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: 7XG611.01, VG1311.01