DOCTORS MEDICAL CENTER

Report ID: 6I7311, California Department of Public Health

Reported Entity: DOCTORS MEDICAL CENTER

Issue:

Based on staff interview, clinical record and administrative document review, the hospital failed to ensure confidential treatment of Patient 1 - 4's protected health information (PHI) when:1. Patient 1's PHI was faxed to a local business instead of the health care provider. (CA00388621)2. Patient 2's PHI was given to Patient 3. (CA00396048)3. Patient 4's PHI was given to Patient 5. (CA00396649)4. Patient 6's PHI was sent in error to a Skilled Nursing Facility. (CA00396708)Findings:CA003886211. On 3/21/14 at 11 a.m., during a telephone interview, the Privacy Officer (PO) stated that on 2/13/14 a hospital employee (Operator) entered an incorrect number into the fax machine and sent Patient 1's PHI to a local business instead of the health care provider. The PO stated that the employee should have double checked the fax number before sending, but this was not done.Patient 1's PHI breached included her name, date of birth, medical record number, account number, date of service, medical history, and physical examination results.The hospital's policy and procedure titled "Transmission of Medical Records by Facsimile" dated 5/16/12, indicated "... Sender Procedure... Verify by telephone the availability of the authorized receiver before beginning transmission... Verify from either the Communication/Transmission Result Report OR [Hospital] Patient Information System Audit Trail; the FAX was sent to the correct phone number."CA003960482. On 6/12/14 at 9:30 a.m., during a telephone interview, the PO stated that on 4/14/14 a hospital employee (Emergency Department Nurse) included the discharge instructions for Patient 2 with Patient 3's discharge packet. The PO stated the employee should have double checked the paperwork before giving it to the patient, but this was not done.Patient 2's PHI breached included his name, medical record number, age, physician, date of service, and medications.The hospital's policy and procedure titled "Information Privacy and Security Administration Policy" dated 9/16/13, indicated "... [Hospital] Facilities must have appropriate administrative, technical, and physical safeguards to protect the privacy and security of PHI and other confidential information. The safeguards will be designed to reasonably protect PHI and other confidential information from any intentional or unintentional use or disclosure that violates federal and state regulations. [Hospital] will also put in place safeguards to limit incidental uses or disclosures that are made pursuant to permitted or required uses or disclosures."CA003966493. On 6/12/14 at 9:40 a.m., during a telephone interview, the PO stated that on 3/28/14 an unknown employee in the emergency department gave discharge instructions for Patient 4 to Patient 5. The PO stated all paperwork should be double checked before giving it to the patient, but this was not done.Patient 4's PHI breached included her name, age, date of service, physician, diagnosis, medical record number, and medications.The hospital's policy and procedure titled "Information Privacy and Security Administration Policy" dated 9/16/13, indicated "... [Hospital] Facilities must have appropriate administrative, technical, and physical safeguards to protect the privacy and security of PHI and other confidential information. The safeguards will be designed to reasonably protect PHI and other confidential information from any intentional or unintentional use or disclosure that violates federal and state regulations. [Hospital] will also put in place safeguards to limit incidental uses or disclosures that are made pursuant to permitted or required uses or disclosures."CA003967084. On 6/12/14 at 9:50 a.m., during a telephone interview, the PO stated that on 4/21/14 a hospital employee (Case Manager) faxed Patient 6's PHI to a Skilled Nursing Facility along with another patient's information. The PO stated that the employee should have double checked all paperwork before sending it, but this was not done.Patient 6's PHI breached included her name, medical record number, account number, date of birth, physician progress notes, lab results, and operative reports.The hospital's policy and procedure titled "Information Privacy and Security Administration Policy" dated 9/16/13, indicated "... [Hospital] Facilities must have appropriate administrative, technical, and physical safeguards to protect the privacy and security of PHI and other confidential information. The safeguards will be designed to reasonably protect PHI and other confidential information from any intentional or unintentional use or disclosure that violates federal and state regulations. [Hospital] will also put in place safeguards to limit incidental uses or disclosures that are made pursuant to permitted or required uses or disclosures."

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights