HospitalInspections.org

Based on interview and documentation review it was determined the Hospital failed to ensure the contracted pathology service was in compliance with all of the Conditions of Participation and that patients' individually identifiable health information was disposed of appropriately to protect their privacy, in accordance with standards of practice.

Refer to TAG # A-0441,

Based on interview and documentation review it was determined the hospital failed to ensure the Quality Assurance activities conducted in relation to the contracted pathology service included evaluation of the method utilized for disposal of of patients' individually identifiable health information and that the method was effective and in compliance with hospital policies .

Refer to TAG # A-0441, A-0267

Based on interview and documentation review it was determined the hospital failed to measure and track how patients' individually identifiable health information was disposed of by the contracted pathology service to ensure all patients' personal privacy was maintained.

Refer to TAG # A-0441

Based on interview and documentation review it was determined the Hospital failed to ensure the confidentiality of all patients medical record information was maintained by the contracted pathology service in accordance with hospital policies.

Findings include:

The contract between the Hospital and the Pathology Services Group was reviewed. The contract stated the Physician (Pathologist) shall abide by the by-laws, rules, regulations, policies and directive of the Hospital....As part of the Hospital's overall quality assurance and risk management programs, (the) Physician shall establish quality assurance and risk management programs, policies and procedures to ensure the equality and consistency of all services provided in the Department by Pathologists and other Department personnel, and shall participate in Hospital's quality assurance and risk management programs in accordance with Hospital Policies and the applicable policies of any governmental or accrediting organization including, but not limited to the Joint Commission on the Accreditation of Healthcare Organizations.

The Pathology group's business associate agreement with the billing company was reviewed. The Agreement stated (the purpose was to comply with the health insurance portability and accountability act of 1996 and implementing regulations the billing company agree as follows:..................................#13 Upon termination of its relationship with the Pathology Services Group the billing company shall, if feasible return and destroy all of the protected health information that the billing company still maintains in any form and shall retain no copies of such information. If such return or destruction is not feasible, the billing company shall extend the protection of this agreement to the protected health information and shall limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.

The Contracted billing service had failed to follow the business associate agreement as evidenced by its inappropriate disposal of documents containing personal health care information and personal identification information at a trash transfer station.

The Director of Medical Information Services was interviewed in person on 8/18/10 at 9;30 AM. The Director of Medical Information Services said the Chief Compliance Officer would be talking with the new owner of the billing company later in the day on 8/18/10,

The Hospital policy that addressed disposal of protected health information was reviewed. The policy stated to ensure that all Hospital medical staff, employees, volunteers and students safeguard protected health information by ensuring appropriate disposal of all hard copy documentation containing protected health information. Documents containing protected health information will be either shredded or placed in the locked confidential containers.

The Hospital policy that addressed protecting patient privacy was reviewed. The policy stated Personnel must dispose of paper personal health information by shredding or placing in locked recycle bin.

The Chief Compliance Officer was interviewed by telephone on 8/18/10 at 9:55 AM. The Chief Compliance Officer said the Hospital had no formal way to audit contracted services related to how the contracted services were handling/disposing of patient's personal health information. He/She said at the present time He/She only knew what was in the newspaper. The Hospital was still in the process of trying to determine if there was a legal breach and were still investigating

Based on interview and documentation review it was determined the Hospital failed to ensure there was an adequated and established system in place to ensure unauthorized individuals could not access the records of patient provided services by the hospital contracted pathology service.

Findings included:

Refer to Tag A-0441