HospitalInspections.org

Based on reviews of documents, policies and procedures and staff interviews, it was determined the facility failed to ensure that patients' medical records were secured and kept confidential. Specifically, two members of the staff facilitated unauthorized access to medical records of numerous patients which was sold to members of the public. This was found for Staff #1 and #2.
Findings include: During an interview which was conducted on August 26, 2015 at 11:15 AM, Staff #3, the Senior Privacy Manager of Compliance employed at this facility stated that on Friday May 15, 2015, a police officer from the New York City Police Department (NYPD) informed her that there had been a potential breach in confidential information of patients that had sought medical care at the facility.

After being informed of this Staff #3 stated that on the weekend the facility ran an audit of the 14 individuals that was thought to have a breach in confidentiality, and identified that Staff #1, a unit secretary on one of the units at the Moses Division had accessed 9 of the 14 individuals listed on the evidence which consisted of 2 face sheets and a list of 12 individuals. Further auditing of the Electronic Medical Record (EMR) system revealed Staff #1 had increased her access to the (EMR) and her productivity from January 2013 to June 2013 to a total of 10,598 patients. A normal pattern of access was noted before and after the above dates. This interviewee stated that the facility "worked with" officers from NYPD and the District Attorney (DA) to investigate the cases.

As a result of these findings Staff #1 was terminated from working at the facility.
Staff #3 also stated during this interview that further auditing of their system revealed that Staff #2, who was also a unit secretary on the same patient care unit, had increased productivity and accessed 1,853 patients between February 2013 and March 2013. She was terminated from the facility in July 2015.

As a result of these activities there was unauthorized access by Staff #1 and Staff #2 to numerous patients medical records.

A review of the facility's policy titled "Maintenance of Medical Record" which was last revised in 5/13, states, "medical records or portions thereof ... are protected by safeguards to ensure security and confidentiality. These include policies and procedures that restrict access to information to those individuals with a need by (a) an individual's use of the system and (b) those users who accessed a particular patient's records." The policy further states "Montefiore maintains strict policies to protect confidential information from inappropriate and unnecessary exposure, use and loss."


Based on the findings and interviews noted above, members of the facility's staff were not effective in their role in protecting and ensuring numerous confidential data of patients who sought medical care at its facilities. Based on staff interviews, the breach in confidentiality affected individuals from at least 40 states in this country.

Based on review of medical records, documents and staff interviews, it was determined the facility failed to ensure that all patients received care according to its policies and current standards of practice. Specifically, the staff failed to (1) perform complete assessments and reassessments and (2) failed to address abnormal findings. This was found in 2 of 16 medical records reviewed. (MR #1 and MR#2).
Findings include:
1). A review of patient MR#2 on August 27, 2015 identified the following information: A forty-five year old patient presented to the Emergency Department (ED) on May 26, 2015 at 10:49 PM in respiratory distress as evidenced by shortness of breath and an oxygen saturation of 79%, on oxygen 10 liters per minute (normal range is 96-100% on room air). The patient's presenting complaint was shortness of breath for 3 days. The patient also had a history of substance abuse. The patient was "diaphoretic, tripoding and had pinpoint pupils." The previous medical history was significant for Hypertension, Diabetes Mellitus (DM), Coronary Artery Disease and Pulmonary Embolus/Deep Vein Thrombosis. Assessment at 11:09 PM that night revealed a Pulse rate of 125 beats per minute (normal is 60-100), Respirations of 32 (normal is 12-20) and the Blood Pressure (B/P) was 205/136 (normal is 90/50 - 120/80).
Further review of the medical record revealed the patient was using accessory muscles to compensate for his difficulty breathing. The patient was placed on Bipap and his respirations were not reassessed until it rose to 55 breaths per minute, at which point he was intubated at 11:35 PM that night.

This was not a timely intubation and it does meet current standards of practice, given the patient's long history of shortness of breath and labored breathing. In addition, despite the patient's significantly elevated blood pressure and pulse rate, the patient's vital signs were not reassessed until 12:05 AM on May 27, 2015 when he was found pulseless, which was more than an hour after his arrival to the ED. The patient was pronounced dead at 12:29 AM that morning when Advance Cardiac Life Support measures were unsuccessful.
Review of the facility's policy "Assessment of The Patients in the Emergency Department," last revised 2/15, revealed: the patients vital signs must be repeated as necessary until stable. The policy also states the vital signs must be reassessed "immediately if abnormal in triage." This policy for reassessment was not followed despite the patient's extremely elevated blood pressure and heart rate upon arrival.
2). A review of patient MR#1 on August 26, 2015 identified the following information: this thirty-two year old patient presented to the ED at 5:18 PM on March 29, 2015 with complaints of right shoulder and head abscesses, nausea and vomiting. The patient's previous medical history was significant for but not limited to Hypertension and Diabetes Mellitus (DM) for which she was taking Lantus Insulin. The patient also had a history of End Stage Renal Disease and she received Hemodialysis Mondays, Wednesdays and Fridays. The triage classification was level III. The patient was admitted to the facility 3 months prior in December 2014 with Diagnoses of Abscesses and Diabetic Ketoacidosis (DKA).
Review of the policy titled "The Triage Assessment" revealed the name, dosage and frequency of medications taken at home should be documented in the patient's medical record. There was no documentation that this was done.

At 6:30PM, there is documentation of an elevated blood sugar of 268 mg/dl (normal is 70-110 milligram/deciliter), at 6:50PM for this patient. Labs were ordered by the physician at 8:57 PM, but there was no evidence that that labs were drawn nor was there any evidence that the staff followed up on the order or results.
Patient MR#1 was found unresponsive at 4:58 AM on March 30, 2015, at which point the finger stick was done and the result was noted to be 486 mg/dl. (A critical result is in excess of 400 mg/dl). The patient was pronounced dead at 5:26 AM that morning when resuscitative measures proved futile.
Review of the policy titled "Assessment of patients in the Emergency Department" which was last revised 2/15 revealed a level III patient's vital signs will be repeated every 4 hours if stable until admission, discharge or unless written physician's order specify otherwise.
Patient #1's vital signs were not monitored according to this policy. The patient was not reassessed periodically or at a minimum every 4 hours by a physician or a nurse. In addition, there is no documentation that the labs were drawn as ordered.
These findings were confirmed with the Medical Director on August 28, 2015 during an interview which was conducted at 1:50 PM.