MERCY HOSPITAL OF FOLSOM

Report ID: 8QYE11, California Department of Public Health

Reported Entity: MERCY HOSPITAL OF FOLSOM

Issue:

Based on staff interview and document review the facility failed to prevent an unauthorized disclosure (Breach) of 7 of 7 sampled patients' (patient 1-7) medical information (PHI). Findings:1. CA00425838 - On 1/5/15 the facility reported to the Department that on 12/15/14 Patient 1's discharge paperwork was given to another patient. The breach was not detected until 12/31/14 when the other patient notified the facility.2. CA00423709 - On 12/15/14 the facility reported to the Department that a Business Associate misdialed a fax number sending PHI for Patient 2 to a wrong number. 3. CA00423643 - On 12/12/14 the facility reported to the Department that two patients (Patient 3 and 4) called back to the facility to report they received discharge paperwork for another patient. The two patients calling in the error, did not tell the facility the patient names on the paperwork, so the facility was unable to identify breach Patients 3 and 4 and notify them.4. CA00419148 - On 11/4/14 the facility notified the Department that an explanation of benefits (containing PHI) for Patient 5 was mailed to an incorrect patient who had the same name. The Compliance Officer (CO) was interviewed on 7/16/15 and reported that during the registration process for Patient 5, she was registered under the other patient's medical record number. 5. CA00406166 - On 7/18/14 the facility reported to the Department that a billing statement (containing PHI) for Patient 6 was inadvertently included in paperwork sent to another patient. 6. CA00401863 - On 6/12/14 the facility reported to the Department that discharge paperwork for Patient 7 was given to the wrong patient.On 7/16/15 the facility's Compliance Officer was interviewed and confirmed the breaches listed above occurred as reported.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280