HospitalInspections.org

This CONDITION is not met as evidenced by:

Based on observation, hospital policy review and staff interviews, the critical access hospital (CAH) failed to ensure hospital staff safeguard the confidentiality of patient medical record information through the following:

1) unsecured patient medical record information in open shred bins in the Medical/Surgical Department nurse'ss station and Laboratory Department.

2) unsecured patient medical record information in a Pathology/Send-out testing log binder on the countertop in the Laboratory Department.

The cumulative effect of these processes resulted in the potential for patient Protected Health Information to be available for unauthorized access/use of the information at multiple locations in the hospital, affecting patients receiving both inpatient and outpatient hospital services (see C1120).

Based on observation, hospital policy review and staff interviews, the critical access hospital (CAH) failed to ensure hospital staff safeguard the confidentiality of patient medical record information against the potential of unauthorized access/ use of the information through unsecured patient medical record information in open shred bins in the Medical/Surgical Department nurse's station and Laboratory Department, along with a Pathology/Send-out testing log binder on the countertop in the Laboratory Department.

The CAH reports an average daily census of 5 patients seen per day in the Medical/Surgical Department.

Failure to ensure CAH staff safeguard the confidentiality of patient medical record information against the potential of unauthorized access/use placed patients at risk for loss of privacy and theft of their protected health information.

Findings include:

1. Review of the hospital ' s policy, titled Destruction/Disposal of Patient Health Information, dated 5/2024, revealed the purpose of the policy was to establish guidelines for the appropriate destruction of a variety of media that may contain protected patient health information. The policy directed staff to place patient information in a separate wastebasket that was marked and shredded.

2. On 10/22/24 at 8:15 AM, observation during a tour of the Medical/Surgical Department with the Medical/Surgical Manager revealed the Medical Surgical Department was located on the first floor of the hospital. Observation of the Medical Surgical nurse's station revealed two unsecured open wastebaskets with a paper taped on the front of each instructing staff to place any documents with patient information in it. The wastebaskets were over half-filled with patient identifiable information. The nurse's station was a large open area with no doors.

During an interview 10/22/24 at the time of the tour, the Medical/Surgical Manager explained staff were instructed to place all papers with patient information in the wastebaskets and the information was gathered at the end of the day and taken to a locked shred bin in the basement until the contracted shredding company came to remove it. The Medical/Surgical Manager reported housekeeping came into the area throughout the day to clean and confirmed the unsecured shred wastebaskets had potential for unauthorized persons to gain access to the patient healthcare information. The Medical/Surgical Manager confirmed there were times that staff left the nurse's station unoccupied.

3. On 10/21/24 at 1:18 PM, observation during a tour of the Laboratory Department with the Laboratory Manager revealed the Laboratory Department was located on the first floor of the hospital. The surveyor observed a Pathology/Send-out testing log binder on the countertop that contained 65 names of patients identifying specimens that were sent for pathology or send out blood tests. Observation in the Laboratory Department revealed three unsecured open wastebaskets with a paper taped on the front of each instructing staff to place any documents with patient information in it, one located under the Laboratory Registration desk and two located in the Laboratory Technician work area. Observation revealed two doors with key lock access to the Laboratory Department.

During an interview 10/21/24 at the time of the tour, the Laboratory Manager confirmed the binder with patient health information was left on the countertop at all times. The Laboratory Manager explained staff were instructed to place all papers with patient information in the wastebaskets, the information was gathered at the end of the day, and taken to a locked shred bin in the basement until the contracted shredding company came to remove it. The Laboratory Manager reported the Laboratory Department was not staffed after 4:00 PM to 7:00 AM every night. Housekeeping and Maintenance staff had keys to access the doors (staff that would not have a need to access/know HIPPA protected information).