RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Report ID: F3D911.01, California Department of Public Health

Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to prevent unauthorized disclosure of PHI (protected health information) for one patient (Patient 1) when a medication list for Patient 1 was given to a different patient upon discharge from the ED (emergency department). This failed practice resulted in unauthorized persons having access to the PHI for Patient 1 for a prolonged period of time, and the potential for emotional and financial harm to Patient 1.Findings:During an interview with the facility PO (privacy officer) on April 23, 2014, at 11:50 a.m., the PO stated on March 5, 2014, Patient 2 was discharged from the ED, and given the medication list for Patient 1. The PO stated Patient 2 kept the information until she returned again to be seen in the ED, on April 18, 2014 (44 days later). The PO stated Patient 2 provided the medication list to staff and told them it was given to her the last time she was at the facility.A review of the document given to Patient 2 indicated the document contained the following PHI for Patient 1:1. Name (first, middle, and last);2. Sex;3. Date of birth;4. Medical record number;5. Account number; and,6. A list of medications Patient 1 was taking (one for seizures and one for an infection).Providing this information to Patient 2 resulted in access to Patient 1's PHI by persons who were not authorized to have it.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

1 other violation reported on the same date. Note that other citations may be about the same event: RNIR11.01