HospitalInspections.org
Bringing transparency to federal inspections
OREGON STATE HOSPITAL DISTINCT PART
PROTECTING PATIENT RECORDS
Tag No.: A0441
Based on interviews and the review of documentation, it was determined that the hospital failed to ensure the confidentiality of patient records.
Findings:
An interview with the CMO at 10:30 AM on June 5, 2012 revealed that on Friday, April 13, 2012 several items were taken from the car of the CoP for the hospital. Information obtained during this interview revealed that the car had been parked in front of a health club and the items were stolen while the CoP was in the club. The CMO stated during this interview that 3 sets of documents had been taken. These included a printed list of over 500 names, including patient names, 20 progress notes that had been selected from a list of 291 patients, and a personal notebook that belonged to the CoP. Additional information revealed that the CoP was not able to recall the exact patient names, specific details, and potential identifiers that were included in this notebook.
The CMO indicated during this interview that he/she was notified by the CoP "immediately" when the theft was discovered, including the specific items taken and scope of the theft.
The review of documentation presented revealed a form entitled, "Administrative Services Information Security Office DHS/OHA Privacy/Security Incident Report" that had been completed by the CoP on April 16, 2012. Documentation on this form reflected that his/her car had been broken into on April 13, 2012 and items were stolen from the passenger compartment and the trunk. Documentation reflected that the items stolen included a backpack, personal organizer (contained patient information), doctors' caseload reports (contained patient information), individual progress notes (contained patient information), and miscellaneous items (flash drive, policies, and projects) that did not contain patient information.
The CMO stated that the CoP did an immediate search of the area surrounding the health club when the theft was discovered, but none of the stolen items, including any of the confidential patient information, were located.