HospitalInspections.org

Based on review of documents and staff interviews, it was evident the hospital's governing body did not provide sufficient accountability and oversight for the monitoring of a contracted service responsible for transporting and storing back up tapes containing confidential protected health information.
Specific reference is made to an occurrence on 12/23/10 that involved the theft of back-up tapes containing confidential protected health data.

Findings include:

On 12/23/10, an incident occurred whereby a three week cycle of back up tapes of data containing confidential hospital medical records and fetal monitoring systems was stolen from an allegedly unlocked truck that was parked while the driver made a stop enroute during the process of traveling to the hospital for delivery. The truck was operated by a driver who worked for the contracted company responsible for transport and off -site storage of these electronic back up tapes. The loss of data affected approximately 1.6 million patients and staff at 4 health care facilities with records dating back approximately 20 years.

The hospital did not provide sufficient monitoring of the services provided by contracted vendor company #1 (GRM) as follows:
-Review of the contract on 5/2/11 found that the company did not specify the security procedures of the tapes while enroute during transport.
-The contract did not specify the need to provide additional security of the information contained on tapes, through issuance of password protection or encryption in the event of loss or theft while enroute to secure off-site storage location.
-During observation of a sample container on 5/2/11 during the afternoon hours, it was noted the transport case was secured with plastic strips, that were used to "lock" the containers, but these devices could be easily removed with a scissor.
-Interview with staff #s 1,2, 3, 4, and 5 on all dates of the survey found that the vendor's operating procedures as referenced in the contract were not available either in the hospital or from the NYC Health and Hospital's Corporation (HHC) , which owns and operates the facility.
.


16399

Based on document review and staff interviews, it was determined that the facility failed to implement a coordinated system for the monitoring and evaluation of the quality of its contracted services and therefore did not fully ensure that each contracted service is provided
in a safe and effective manner.

Findings include:

1. The hospital did not provide a comprehensive listing of all its contracted services to survey staff until following the conclusion of the survey.
The hospital was given a written request during the survey entrance conference at 9:45 AM on 5/2/11 which included a request for the provision of a list of all contracts for the facility and quality monitoring. At the time of the exit conference conducted on 5/4/11 between the hours of 5 and 5:30 PM, a complete listing of non-clinical contracts for the facility had not yet been provided and was unavailable.

Staff #2 indicated this information would be available by fax the following day because they had to obtain additional information about contracts at the Health and Hospitals corporate level . It was stated at interview with staff #1 and 2 on 5/4/11 that contracts at the local (or network) level are to be monitored by the specific department providing care or services that utilizes the services provided by the contract and that corporate contracts are monitored by the corporation. However, there are a few exceptions in that some of the corporate contracts will receive supplemental monitoring by the specific department involved.

On 5/5/11, a list of all hospital non-medical contracts was subsequently faxed by the hospital to the State Agency surveillance staff, which included a listing of 164 contracts doing business with the facility. Of these, 70 were corporate contracts issued by the corporate owner, the New York City Health and Hospitals Corporation (HHC) and 71 were local Jacobi Hospital contracts. The remaining 23 were state contracts.

2. Review of available data found that the hospital did not provide sufficient oversight of its contracted services. There was no evidence the hospital developed a coordinated system for monitoring of non- clinical contracts and agreements. During review of documents and interviews with staff on all dates of the survey, it was revealed that the facility did not have a coordinated mechanism for evaluation of the quality of each non- medical contracted service provided. The hospital also did not consistently develop its own specific indicators unique to each contract, in order to evaluate the specific services provided, i.e., measurement of provision of contract deliverables.

The review of seven non-medical contracts revealed no evidence of any quality assurance and performance improvement (QAPI) monitoring of three contracts for company#s 1, 2, and 3.

Of the remaining 4 contracts reviewed, the following issues were identified:

-- Contract #4: This correspondence company's reports were limited to numerical reports of turnaround times for release of information. This data was based on a report generated by the company. No specific indicators were developed by the hospital. While a supplemental memo received following the survey indicated the Health Information management (HIM) department discusses percentages that fall below performance benchmark levels with the contracted agency's regional manager, reports detailing the analysis of this numerical data were not included.

--Contract #6: While the hospital developed its own indicators to measure the company providing off site record storage (Contract #6), this report included only numerical data about chart recall delivery turnaround times. Compliance was measured for chart recalls for the period from 1/10 - 3/11 and showed numbers that were 100% compliant for turnaround times every month. However, there was no evidence this numerical data was qualitatively reviewed nor evidence that the hospital changed indicators to assess potential new problem areas.

--For contract #7, which was reviewed on-site on 5/4/11, there was no evidence of the hospital's independent analysis of the performance of this contracted vendor. A quantitative report was provided by the hospital on 5/4/11 from the vendor, who was contracted to provide notification and credit monitoring enrollment to persons affected by the incident involving theft of tapes containing protected health information on 12/23/10.

This report was generated directly by the vendor to summarize the number of persons notified, the number of persons who enrolled in the credit monitoring program, and any credit alerts or attacks.

However, interview of staff on 5/4/11 found that no other indicators or assessment of these reports was available to summarize the hospital's independent assessment of the services provided by this vendor.

There was no evidence of any consistent qualitative review of the numerical data collected nor an assessment of the performance for three of four of these contracted companies (contract #s 4,6, and 7).

See also citations noted under tag #s:
-A083 for 482.12 (e) Contracted Services;
-A267 for 482.21 (a)(2) QAPI Quality Indicators.
.












16399

Based on review of contracts, documents, and staff interviews, it was determined that the hospital did not develop independent measures to effectively analyze and monitor the quality of services provided by its contracted companies providing non-medical business services.

Findings include:

It was evident the hospital did not provide adequate quality assurance oversite by either the corporation or affected departments of its contracted services and companies. Specifically there was insufficient evidence of system-wide and coordinated activities to monitor non-clinical services provided by companies contracted to do business with the facility.

Examples:

1. Review of the hospital's quality assurance plan, the Performance Improvement plan for Fiscal Year 2011, did not include a plan to monitor all contracted services. While review on 5/4/11 of the hospital Quality Assurance Committee of the Board of Directors Quarterly reports for 2010 revealed some evidence of discussion of medical contracted services, there was no systematic analysis performed of non-clinical contracted companies.

2. Review of documents and staff interviews identified the following deficiencies evident in the hospital's monitoring of the GRM contract:

--reports for quality assurance and monitoring activities of the company referenced in contract #1 were not provided. There was no evidence of any valid monitoring of the quality and performance of this vendor. It was stated at interview with staff #3 on 5/4/11 that quality monitoring was done on-line but these reports cannot be accessed from the company due to the subsequent cancellation of the contract.
On 5/4/11, copies of transport and inventory logs were provided to survey staff, however these documents were limited to pick up and drop off receipts for transported tapes containing signatures from both hospital and vendor staff.
Examination of these reports revealed these documents did not reflect activities that met requirements for data collection and analysis of the quality and performance of the services covered under this vendor's contract.

3. Additional instances of missing or incomplete review of contracted non-clinical companies were evident as follows for the remaining 5 of 6 remaining contracted services reviewed:

--There was no evidence of any quality review of the performance provided by the company referenced in contract #2, which was engaged on 2/24/11 for the vaulting of back up tapes and secured protected transport.

-- There was no evidence of any quality review of the performance provided by the company referenced in contract #3, which was engaged beginning 10/8/07 for disaster recovery services and live off-site electronic data back up.

--Quality review documents for contract #4, a correspondence company, was provided the day following the survey on 5/5/11. The hospital relied on numerical data provided by the company and did not develop independent monitoring indicators. Supplemental documentation of indicators received from the Health Information Management (HIM) Department was provided on 5/5/11, which indicated a benchmark for performance of 10 business days turn around time and indicated any performance below benchmark would be reported to the contracted company manager. No further quality analysis of the numerical data was evident.

--Quality review data for contract #6, a record storage company, consisted of indicators provided for turn around times of chart retrieval requests. While these indicators were developed by the hospital, quarterly reports of the analysis of this numerical data as planned were not provided. While supplemental detail of the indicators was submitted following the survey on 5/5/11, the activity again indicated that problems are reported to the company supervisor for action. However, there was no provision of additional analysis of this numerical information contained in the indicator summary report or an attempt to develop new indicators, especially since the reports noted 100% compliance each month between 1/10 and 3/11.

--For contract #7, a quantitative report was provided by the hospital on 5/4/11 from the vendor who was contracted to provide notification and credit monitoring enrollment to persons affected by the incident involving theft of tapes containing protected health information on 12/23/10. However, there was no evidence of the hospital's independent analysis of this data by this contracted vendor.

See also citations noted under tag # s:
A083 for 482.12 (e) Contracted Services;
A084 for 482.12 (e)(1) Contracted Services.
.










16399

Based on review of medical records, it was determined the facility did not ensure the accurate filing and inclusion of correct and complete information in patient records. This finding was noted in 3 of 31 applicable patient records reviewed.

Findings include:

Review of patient records on 5/2/11 and 5/3/11 found three instances of inaccurate filing and/or incomplete charting in patient records.

Specific examples include:
During chart review on 5/3/11, documents belonging to MR #9 were filed in MR #8 in error. A hospital form titled "NYCHHC request for amendment" was attached to a birth certificate and other documents, which also included a copy of a social security card with a social security number for a child born on 10/23/10. This child's documents were incorrectly filed in the paper record for an adult (MR #8) who was hospitalized on 2/6/11.

During chart review of MR #7 on 5/2/11, it was noted that informed consent form were improperly completed and did not contain specific information as required for informed consent by telephone. Specifically, this patient who was intubated on a ventilator (trach to vent), received a pleurocentesis on 4/11/11. The patient had a valid health care proxy. Review of the informed consent for pleurocentesis revealed the consent was incomplete. The written informed consent had written "phone consent" on the line requiring signature by a Health Care Agent or Legal Guardian. The identity of the health care agent was not specified on this consent form. The pleurocentesis procedure note dated 4/11/11 indicated the MD had "verified the performance of the invasive procedure by the following: History, physical exam, radiographic studies, informed consent and /or patient /family confirmation."
.

Based on medical record review and interview it was determined that the facility did not ensure medical record entries are complete.

Findings include:

1- Review of MR #s 1, 2, and 3 on 5/3/11 noted that the providers' signatures noted on the Pediatric and Adult Emergency Department paper records for these patients (including history and physicals) did not document their titles.

The surveyors was unable to determine if these providers were Residents or Physician Assistants, who would require evidence of supervision by an Attending Physician.

2- Review of Medical Record #s 4 and 5 lacked evidence of medical staff's signature. These records were not signed by the Medical Provider nor the Attending Physician.
.