HospitalInspections.org

Based on observation, staff interview, clinical record, and administrative document review, the facility failed to ensure sufficient safeguards were in place when an unlocked filing cabinet containing protected health information (PHI) was observed in an occupied patient room. This failure resulted in the potential for abuse of PHI.

Findings:

On 10/18/11 at 9:45 a.m., during a concurrent observation, interview, and record review, a two drawer metal filing cabinet was observed in room 4N21. A patient receiving hemodialysis was observed occupying this room. LN 12 was asked what purpose the filing cabinet served. He stated the filing cabinet contained the daily hemodialysis records. When asked if the records were specific to the patient in room 4N21, he stated no, the records were for all patients receiving hemodialysis in the hospital. When questioned whether the cabinet was kept locked, He stated no, it was not locked. LN 12 was asked to retrieve the documents contained in the filing cabinet. He was observed walking to the cabinet and opening it ( the cabinet was unlocked) and bringing the records for one month, June 2011. The "Acute Hemodialysis Daily Record" dated June 30, 2011, indicated there were five different patient names, and included the medical records numbers, sex, age, date of birth, physicians, Time on/time off (dialysis), treatment time ordered, access (type of dialysis access), nurse assigned and acuity/comments.

On 10/18/11 at 12:40 p.m., during an interview, LN 12 stated maintenance is bringing locks up for the filing cabinet. He further stated the cabinets had been in patient room 4N21 for approximately 12 years and had been used to store the "Acute Hemodialysis Daily Records" for about 3 or 4 years. He explained the current month records were stored in a shelf next to the nurses desk and at the end of the month the records were moved to the filing cabinet in room 4N21. He further stated facility staff are not always present when patients in room 4N21 have visitors.

On 10/18/11 at 12:43 p.m., during an interview, the Assistant Nurse Manager (ANM) stated if maintenance could not place locks on the filing cabinet the records would be moved to a secure location.

The facility policy and procedure, title "Patient Rights and Responsibilities" dated 9/27/10, indicated in section "I. Patient Rights" the patient has the right to ..."12. Confidential treatment of all communications and records pertaining to their care and stay in the hospital..."

The facility policy and procedure, title "Patient Access to and Release of Health Information" dated 12/08/08, indicated "POLICY: ... All District personnel will safeguard all health information records against loss, tampering, use by unauthorized persons, and damage."