HEMET VALLEY MEDICAL CENTER

Report ID: WBN211, California Department of Public Health

Reported Entity: HEMET VALLEY MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 1). Patient 1's confidential information, via an information label, was placed on a bag of intravenous (IV - fluid given directly into a vein) solution that was hung and being administered to Patient 2. This resulted in the unauthorized disclosure of Patient 1's protected health information (PHI).Findings:On June 25, 2013, at 12:20 p.m., an interview was conducted with the Director of Health Information Management (DHIM) and the Director of Inpatient Services (DIS). They stated: a. On May 8, 2013, Patient 2's family member reported to the certified nursing assistant that the bag of intravenous solution currently being administered to Patient 2 had the information label for Patient 1 affixed to the bag of solution.b. The certified nursing assistant notified Patient 2's Registered Nurse who removed the bag of IV solution, and hung a new bag of IV solution with Patient 2's information label. The RN verified that the original IV solution hanging was the correct IV but had been mislabeled with Patient 1's information label.Patient 2 and Patient 2's family member had an opportunity to view Patient 1's PHI, which included name, account number, physician's number, and order number.Patient 1 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on May 15, 2013, to her last known address.The California Department of Public Health (CDPH) was notified via a facsimile dated May 15, 2013, of the unauthorized access of Patient 1's PHI.The facility policy and procedure titled "Breach of PHI - Notification Requirements" dated November 2010, revealed "... The Hospital shall report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the nearest regional office of the California Department of Public Health no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ... The Hospital shall also report in writing, by facsimile and certified mail, return receipt requested, any unlawful or unauthorized access to, or use or disclosure of, a patient's medical information to the affected patient or the patient's representative at the last known address, no later than five (5) business days after the unlawful or unauthorized access, use, or disclosure has been detected by the Hospital. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280