Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
ST MARY MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on January 16, 2014. Also cited in 55 other reports.
Report ID: 8VBW11, California Department of Public Health
Reported Entity: ST MARY MEDICAL CENTER
Issue:
Based on interview and record review the facility failed to ensure confidential treatment of Patient A's protected health information (PHI), when a copy of the Discharge Medication Reconciliation form was inadvertently placed in the discharge packet of Patient B. This resulted in a breach of PHI for Patient A.Findings:An unannounced visit was made to the facility on January 16, 2014 at 3:50 PM, to investigate an entity reported incident of a possible breach of PHI for Patient A.During an interview with the privacy officer on January 16, 2014 at 3:55 PM, she stated, "On December 30, 2013, the manager of the telemetry unit was notified that Patient B had been given the Discharge Medication Reconciliation form intended for Patient A on December 24, 2013. The registered nurse (RN) remembered having multiple discharges on that shift and had asked Patient B's physician if he wanted any discharge medications for Patient B. Patient B's physician had told the RN to have Patient B continue her medications she had at home."A review of the Discharge Medication Reconciliation form was reviewed, and indicated the form contained Patient A's name,age, sex, height, weight, medical record and account numbers, a list of medications and the corresponding diagnoses.During an interview with the nurse manager from the telemetry unit on January 16, 2014 at 4:10 PM, she showed how Patient A and Patient B had the same first name and their last names were similar. Both had been discharged on December 24, 2013. Patient A at 2:02 PM, and Patient B at 2:19 PM. Per the Unit Manager, "Patient A received all the correct documents. Patient B also received all the correct documents plus a copy of the medication form intended for Patient A."A review of the facility policy and procedure titled, "Confidentiality," dated January 2012, was conducted with the facility privacy officer and Unit manager. Both agreed that a breach had occurred, when Patient A's PHI had been released without authorization.
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights