HospitalInspections.org

Based on observation, hospital policy review and staff interviews, the critical access hospital (CAH) failed to ensure hospital staff safeguard the confidentiality of patient medical record information against the potential of unauthorized access/use of the information through unsecured patient medical record information in open shred bins in the Laboratory Department and Health Information Management Department (HIM), along with unsecured fax machines after hours that may receive patient medical record information including orders in the Rehabilitation Therapy Department, Myrtue Access Center office, and the Diabetic Education office area. The CAH reported an average census total of 540 patients per week in the outpatient Specialty Clinic/Rehabilitation areas, and a daily average census of 7 patients per day in the CAH inpatient areas.

Failure to ensure CAH staff safeguard the confidentiality of patient medical record information against the potential of unauthorized access/use placed patients at risk for loss of privacy and theft of their protected health information.

Findings include:

1. Review of the hospital 's policy, titled "Employee Access to PHI", last reviewed 2/2024, revealed "... Access to patient records is limited to authorized business purposes only ... ... Myrtue Medical Center workforce has a duty to protect protected health information ...".

2. On 11/18/24 at 3:30 PM, observation during a tour of the Laboratory Department with Staff C revealed the Laboratory Department was located in the basement of the hospital, with one locked door that had badge access. Observation in the Laboratory revealed one unsecured open wastebasket (with a taped piece of paper that had typed "Shred" on it) that was full to the top of patient information.

During an interview 11/18/24 at the time of the tour, Staff C explained staff place papers with patient information in the wastebasket and the information was gathered once a week by Environmental Services (EVS) and taken to a locked shred bin until the contracted shredding company came to remove it. Staff C confirmed the unsecured shred wastebasket had potential for unauthorized persons to gain access to the patient healthcare information.

During an interview 11/19/24 at 8:25 AM, EVS Manager confirmed the unsecured shred wastebasket was emptied weekly in the Laboratory area and taken to a locked shred bin until the contracted shredding company came to remove it every 4 to 6 weeks.

3. On 11/19/24 at 10:45 AM, observation during a tour of the hospital ' s Diabetic Education Nurse ' s office area with the Diabetic Education Nurse revealed 1 unsecured fax machines after hours that may receive patient medical record information including orders in the Diabetic Education Nurse ' s office area.

4. On 11/19/24 at 12:45 PM, observation during a tour of the hospital ' s outpatient Specialty Clinic with the Director of Specialty Clinics revealed 2 unsecured fax machines after hours that may receive patient medical record information including orders in the Rehabilitation Therapy Department, and the Myrtue Access Center office.
During an interview on 11/19/24 at the time of the tour, the Director of Specialty Clinics confirmed the unsecured fax machines had potential for unauthorized persons to gain access to the patient healthcare information after hours.

5. On 11/19/24 at 2:25 PM, observation during a tour of the hospital ' s Health Information Management (HIM) Department with the HIM Supervisor revealed 1 unsecured open cardboard box under the HIM Supervisor ' s desk they place any documents with patient information in it, that was half full.
During an interview on 11/19/24 at the time of the tour, the HIM Supervisor explained they place papers with patient information in the open box and the information was gathered once a week by Environmental Services (EVS) and taken to a locked shred bin until the contracted shredding company came to remove it. The HIM Supervisor confirmed the unsecured shred wastebasket had potential for unauthorized persons to gain access to the patient healthcare information.

6. During an interview 11/19/24 at 4:00 PM, the CNO further explained maintenance staff would be the only other staff who had access to the Laboratory Department, HIM Department, Rehabilitation Therapy Department, Myrtue Access Center office, and the Diabetic Education office area after hours.

Based on observations, policy review, and staff interviews, the critical access hospital (CAH) administrative staff failed to ensure the hospital ' s kitchen staff adhered to pertinent policies and procedures of the hospital for 4 of 4 patients in which the survey team observed meal preparation and tray plating. Failure to adhere to policies and procedures set forth by the hospital ' s administrative staff could result in the provision of reduced quality of care and patient safety, foodborne illnesses and infections, cross contamination of harmful pathogens which could include a deterioration in health, disability, or death. The CAH identified an average of 7 patients receiving kitchen staff meal plating in an inpatient setting per day.

Findings include:

1. Review of the hospital 's policy, titled "Food Handling and Preparation", last rviewed 8/2024, revealed "... Employees will use thongs or plastic gloves when handling individual items of foods that will not be further cooked. Employees will be educated on proper glove use upon hire and at least annually at dietary department in-services ...".

2. On 11/19/24 at 11:50 AM, observation during a tour of Foodservice found the Staff S plating beverages without gloves, and placing beverages on patient trays without gloves. The primary kitchen cook plated hot food items, with gloves, however removed them to use a writing pen and then proceeded to scoop out pureed food from the blender, and used a measuring collection device to obtain liquid from the meat reservoir to add to the pureed container without gloves. Additionally, the primary kitchen cook placed a lid on the pureed meat container, without gloves.

3. During an interview on 11/19/24 at the time of the tour, the Registered Dietitian confirmed all kitchen staff should wear gloves throughout the entire food preparation process. The Registered Dietician further explained it was against policy to dip the measuring device to obtain the liquid from the meat without wearing gloves.