Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
KAISER FOUNDATION HOSPITAL - RIVERSIDE
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on September 25, 2013. Also cited in 25 other reports.
Report ID: 59EH11.01, California Department of Public Health
Reported Entity: KAISER FOUNDATION HOSPITAL, RIVERSIDE
Issue:
Based on interview and record review, the facility failed to prevent the unauthorized access of Patient A's medical information. This had the potential to result in misuse of private information.Findings:On September 25, 2013, at 8:30 a.m., an investigation was conducted for an entity reported incident. In an interview with the Compliance Officer (CO) and the Intensive Care Unit (ICU) Manager on September 25, 2013, at 10 a.m., the CO stated an investigation into Registered Nurse (RN) 1's medication usage led to a determination that RN 1 had accessed Patient A's medical record without a legitimate reason. On September 25, 2013, a copy of a letter sent to the estate of Patient A was reviewed. The letter indicated: "During the course of an audit, it was discovered that her protected health information may have been inappropriately accessed by a [facility] employee. The information accessed included her first and last name, medical record number, date of birth and portions of her medical record." The facility policy titled, "Mitigation of Impermissible Uses and Disclosure of Protected Health Information" revised on June 2013, was reviewed. The policy indicated, "Kaiser Permanente (KP) must take action to reduce or eliminate, to the extent feasible, any known harm caused by an impermissible use or disclosure of Protected Health Information (PHI) by KP or its business associates."The policy further indicated, "Protected Health Information (PHI) - Individually identifiable health information including demographic information...created or obtained by a covered entity that is related to an Individual's past, present, or future physical or mental health or condition, including the provision of his/her health care..." The policy further indicated, "...Individually identifiable means that the information either identifies the Individual or there is a reasonable basis to believe that the information can be used to identify the Individual, such as name, date of birth, address...other personal identifiers..."
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280