RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: VG1311.01, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to ensure all patient protected health information (PHI) was kept protected, which resulted in the unauthorized access of the patient's confidential information (Patient 1). Patient 1's confidential information was faxed to a medical clinic on March 4, 2013. This resulted in the unauthorized disclosure of Patient 1's protected health information (PHI).Findings:On August 19, 2013, at 2:10 p.m., an interview was conducted with the Compliance and Privacy Officer (CPO) and the Healthcare Administrative Surveyor (HAS). The CPO stated: a. On February 18, 2013, medical records belonging to Patient 2 were requested by a medical clinic.b. On March 4, 2013, the request was fulfilled by the facility's contracted service and documentation was faxed to the medical clinic.c. On July 22, 2013, the facility received a facsimile from the medical clinic which indicated "wrong records," and the records were attached to the facsimile. The records attached belonged to Patient 1.d. The medical record number for Patient 1 was one number less than the medical record number for Patient 2.e. The medical clinic shredded the original facsimile received. The medical clinic personnel received and had an opportunity to view Patient 1's PHI, which included name, date of birth, medical record number, encounter numbers, and the records from two Emergency Department visits.Patients 1 was informed of the disclosure of her protected health information (PHI) via a letter dated and mailed on July 26, 2013, to her last known address.The California Department of Public Health (CDPH) was notified via a telephone call on July 26, 2013, of the unauthorized access of Patient 1's PHI.The facility policy and procedure titled "Release of Information" revised September 2011, revealed "... Fax only in emergent situation, i.e. patient in doctors office or other patient care facility, etc. ... Be specific on dates of records needed. ..."The facility policy and procedure titled "Breach of Patient Privacy: Reporting Requirements" dated September 23, 2009, revealed "... Whether the complaint involves the unlawful or unauthorized access to, or the use or disclosure of, a patient's medical information ... the violation will be reported to the patient and State within no more than five (5) calendar days from identification of the unlawful or unauthorized access to, or use or disclosure of the patient's medical information. ..."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: 7XG611.01, TUYI11.01