Ukiah Valley Medical Center

Report ID: OVPU11.03, California Department of Public Health

Reported Entity: UKIAH VALLEY MEDICAL CENTER/HOSPITAL D

Issue:

Based on record review, the facility failed to report a breach of protected health information to a patient (Patient 2) within 5 days of the disclosure being detected by the health facility after Patient 2's medical information was handed to Patient 3. This failure violated the provisions of California Health and Safety Code 1280.15 (b) (2). Findings:The California Department of Public Health was notified on 9/17/12 that a, "Breach of Protected Health Information (PHI)," occurred on 9/11/12. Review of a copy of the letter sent to Patient 2 revealed that the facility did not provide written notification, regarding the breach of protected health information (PHI) to Patient 2 until 9/24/12, eight business days after the breach was identified and five days after Patient 2 should have been notified.A review of the facility Policy for, "Facility Reporting of Confidentiality Violations to State and Patient (CA Only)" (10/01/09), indicated the following: "POLICY:COMPLIANCE - KEY ELEMENTS: 3. The facility shall report any unlawful or unauthorized access, use, or disclosure of a patient's protected health information occurring on or after January 1 2009 to the affected patient or the patient's representative at the last known address, no later than 5 calendar days after the unlawful or unauthorized access, use or disclosure has been detected by the facility."

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

The report containing this deficiency also includes information about 3 other violations. Note that these may be related to the same event: OVPU11.01, OVPU11.02, OVPU11.04