Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
RIVERSIDE COUNTY REGIONAL MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on November 7, 2012. Also cited in 123 other reports.
Report ID: UZVF11.01, California Department of Public Health
Reported Entity: RIVERSIDE COUNTY REGIONAL MEDICAL CENTER
Issue:
Based on interview and record review, the facility failed to ensure a FAX (facsimile) number was verified prior to being sent. This failure resulted in the disclosure of Patient A's PHI (protected health information), to unauthorized individuals which potentially impacted the patient's emotional stability and well being. Findings:An interview was conducted with with the facility's Privacy Officer (PO), on November 7, 2012, at 9:30 a.m. The PO stated prior to Patient A's discharge, the patient requested the Clinical Therapist (CT), FAX a note to her place of employment so she could return to work. Patient A and the CT then looked up the employer's FAX numbers and the CT sent the document to two different FAX numbers. An interview was conducted with the Social Services Supervisor on November 14, 2012, at 3:55 p.m. The Supervisor stated Patient A returned to the facility and told her she was embarrassed because the return to work note had, "Department of Psychiatry," indicated on the top of the FAX cover sheet and employees not in the human resources department, where she wanted the FAX's to be sent saw it. Patient A stated she was embarrassed and worried about possibly losing her job.The Supervisor further stated she realized this incident was a HIPAA (health information portability and accountability act) violation, and then reported it to the facility's office of compliance.A review of the facility policy, "Facsimile transmissions (Release Date: 10/25/2012)," was conducted. The policy indicated, "Safeguarding Outbound Transmissions of PHI...verifying fax numbers, including pre-programmed number's. Sending a test fax to any new recipient to confirm that the fax is received prior to transmitting the actual PHI...Sending only the minimum necessary PHI needed to achieve the purpose. Complying with all (facility) privacy, confidentiality, HIPAA, and other compliance policies related to patient information..."An interview was conducted with the PO on November 7, 2012, at 10 a.m., she stated the CT did not confirm the FAX numbers were correct prior to sending the documents to Patient A's place of employment.
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280