RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: 7XG611.01, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's, and the patient's mother's, confidential information (Patient 3 and Patient 3's mother). Patient 3's confidential information was faxed to the incorrect Independent Practice Association (IPA) insurance carrier on July 19, 2013. This resulted in the unauthorized disclosure of Patient 3's (a minor child) and Patient 3's mother's protected health information (PHI).Findings:On August 19, 2013, at 2:25 p.m., an interview was conducted with the Compliance and Privacy Officer (CPO) and the Healthcare Administrative Surveyor (HAS). The CPO stated: a. On July 19, 2013, a facility admissions employee faxed Patient 3's facility "Face Sheet" to IPA Insurance Carrier 1 as a single sheet of paper.b. On July 23, 2013, IPA Insurance Carrier 1 notified the facility that it was in receipt of Patient 3's "Face Sheet" but Patient 3 was not their member.c. The admissions employee had read the IPA Insurance Carrier as "IPA Insurance Carrier 1" when in reality the IPA Insurance Carrier was a different company (IPA Insurance Carrier 2).d. The IPA Insurance Carrier 1 deposited the original document in their confidential shredding container.e. The facsimile machine in admissions did not print confirmations for facsimiles sent.The IPA Insurance Carrier 1 received and had an opportunity to view Patient 3's PHI, which included name, gender, date of birth, medical record number, encounter number, address and telephone numbers. In addition, on the "Face Sheet" was Patient 3's mother's name, date of birth, telephone numbers, address, social security number, and insurance carrier with plan numbers.Patients 3's mother was informed of the disclosure of Patient 3's and her protected health information (PHI) via a letter dated and mailed on July 26, 2013, to her last known address.The California Department of Public Health (CDPH) was notified via a telephone call on July 26, 2013, of the unauthorized access of Patient 3's and Patient 3's mother's PHI.The facility policy and procedure titled "Facsimile Transmissions" released October 25, 2012, revealed "... Employees shall use a fax cover sheet. ... Fax confirmation sheets shall be attached to and maintained with all faxed correspondence. ..."The facility policy and procedure titled "Breach of Patient Privacy: Reporting Requirements" dated September 23, 2009, revealed "... Whether the complaint involves the unlawful or unauthorized access to, or the use or disclosure of, a patient's medical information ... the violation will be reported to the patient and State within no more than five (5) calendar days from identification of the unlawful or unauthorized access to, or use or disclosure of the patient's medical information. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: TUYI11.01, VG1311.01