HospitalInspections.org

Based on staff interview and record review the facility failed to maintain the confidentiality of medical record information for 1 patient in accordance with established policies and procedures. (Patient #2). Findings include:

Per record review, staff failed to adhere to the facility's policy regarding confidentiality of patient information, which resulted in the delivery of confidential medical record information regarding Patient #2 to individuals who were not authorized to receive it and who did not have a need to know the information. On May 28, 2010 A Vermont State Agency received unsolicited confidential medical record information for Patient #2 which included; patient name and date of birth, as well as the results of 2 separate radiological studies. Although the hospital's policy titled, 'Privacy Policy 1 - Patient Confidentiality and Protection of Protected Health Information' (PHI), and dated 2/2010, states; "All material containing PHI must be sent in a sealed envelope labeled legibly as to the intended recipient", the envelope received by the State Agency and containing Patient #2's PHI, did not identify a specific recipient. During interview, at 10:03 AM on 8/24/10, a staff member in the hospital's Radiology Department confirmed s/he had been the individual that had sent Patient #2's PHI received by the State Agency and that s/he had failed to identify, on the envelope, the recipient for whom the information was intended.

Based on staff interview and record review the facility failed to maintain the confidentiality of medical record information for 1 patient. (Patient #2). Findings include:

Per record review, confidential medical record information for Patient #2 was received by individuals who were not authorized to receive it and who did not have a need to know the information. On May 28, 2010 a Vermont State Agency received unsolicited confidential medical record information for Patient #2 which included; patient name and date of birth, as well as the results of 2 separate radiological studies. The information, which had been sent via mail in an envelope that did not include the name of the recipient for whom it was intended was addressed simply to: State of Vermont Disability, Waterbury Complex. During interview, at 10:03 AM on 8/24/10, a staff member in the hospital's Radiology Department stated that the results of radiological studies are often sent, via mail, from the Radiology Department to the ordering physician. S/he confirmed that s/he had sent the information and had failed to identify the recipient for whom it was intended in the address. In addition, per review of the information provided at the time of interview, the Director of Radiology Services confirmed that the envelope also lacked the accurate name and address of the recipient for which it was intended.

Based on staff interview and record review the facility failed to develop a plan to monitor the effectiveness of action implemented as the result of a previously identified deficient practice regarding confidentiality of patient medical record information; and failed to identify a subsequent breach of confidentiality of another patient's medical record. (Patients #1 and #2). Findings include:

Per record review the hospital identified a deficient practice regarding confidentiality of medical record information after being notified, by Patient #1, of the potential breach of confidentiality of their personal medical record information in February, 2010. Patient #1 notified the hospital that staff had sent patient requested medical record information which included; patient name, date of birth, home address, as well as medical diagnosis and laboratory tests, to a public fax, which was accessible to individuals not authorized to receive the information. In response the hospital identified and implemented targeted strategies and interventions that included; education of staff members involved in the incident; revision of the facility's Privacy Policy with respect to transmission of protected health information (PHI) and dissemination of the revised policy to all members of the facility's workforce.

On May 28, 2010 a Vermont State Agency received unsolicited confidential medical record information for Patient #2 which included; patient name and date of birth, as well as the results of 2 separate radiological studies. The information, which had been sent via mail in an envelope that did not include the name of the recipient for whom it was intended was addressed simply to: State of Vermont Disability, Waterbury Complex. The hospital's Medical Records Department and the Department of Radiology were both contacted by the State Agency on 5/28/10 to notify them of the Agency's receipt of the information. During interview, at 10:03 AM on 8/24/10, a staff member in the hospital's Radiology Department confirmed that s/he had sent the information and had failed to identify the recipient for whom it was intended in the address. In addition, per review of the information provided at the time of interview, the Director of Radiology Services confirmed that the envelope also lacked the accurate name and address of the agency for which it was intended.

During interview, on the morning of 8/24/10, both the Director of Medical Records and the Director of Risk Management stated that they had not been aware, until informed by the surveyor, that confidential medical record information regarding Patient #2 had been mistakenly delivered to the State Agency. The Director of Risk Management agreed that, although action was taken to address the issue of deficient practice following the first incident involving Patient #1, there was no plan to monitor and evaluate the effectiveness of those actions. S/he further confirmed that the 2 staff members who had been notified of the issue by the State Agency, on 5/28/10, did not apprise risk management of the issue, and the deficient practice involving Patient #2 had not been identified by the hospital.