Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
LOMA LINDA UNIVERSITY MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on July 28, 2014. Also cited in 44 other reports.
Report ID: N59O11, California Department of Public Health
Reported Entity: LOMA LINDA UNIV MEDICAL CTR EAST CAMPUS HOSPITAL
Issue:
Based on interview and record review, the facility failed to ensure the confidential treatment of protected health information (PHI) for one patient (Patient A), when documents containing PHI of Patient A were inadvertently sent to another patient (Patient B) with a similar name. This placed Patient A at risk for identity theft and the unauthorized release of PHI.Findings: A phone interview was conducted with the Compliance Specialists (CS) on July 28, 2014 at 10:25 AM, to investigate an entity reported incident of a breach of PHI for Patient A. The CS stated that two medical record employees (Employee 1 and Employee 2) inadvertently sent documents containing PHI of Patient A to Patient B, who had a similar name. Employee 1 failed to write the correct medical record number (MRN) on the request authorization to release PHI for Patient A. Employee 2 failed to verify the information prior to mailing documents for Patient A. During a review of the documents for Patient A, the documents included a summarized visit to the emergency room that contained PHI which included: Patient A's name, date of birth, age, gender, chief complaint, medical record number, and diagnosis. The documentation for Patient A was returned by Patient B, and a verbal attestation was obtained indicating that the information had not been retained or further disclosed.During a review of the notification letter sent to Patient A, dated May 10, 2013, the facility indicated on May 07, 2013, the Health Information Management (HIM) department inadvertently sent documents containing PHI of patient A. The documents for Patient A included a summarized visit to the emergency room that contained PHI which included: Patient A's name, date of birth, age, gender, chief complaint, medical record number, and diagnosis. The facility's policy and procedure, titled, "Operating Policy, Patient's Rights, Protection of Patient Privacy," dated May 2013, indicated, "1.1 All medical center employees, members of the medical staff, house staff, volunteers, faculty, and students, shall be responsible for maintaining confidentiality of patient information. This responsibility shall include personal observations, oral conversations, the designated record set and its contents, and any other electronically stored or written patient or patient- related data."The facility 's failure to safeguard the documents containing Patient A's PHI placed Patient A at risk for identity theft and the unauthorized release of PHI.
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights