HospitalInspections.org

Based on clinical record review, facility policy review, and staff interview the facility failed to implement patient privacy rights. Patients' Health information was release without the authorization from the patient.
.
Findings included:
.
Facility document titled "Patient Rights Under the HIPAA Privacy Rule" states in part, "Patients have the right to request that a Facility restrict the use or disclosure of PHI (Protected Health Information) for treatment, payment or health care operations; the disclosure to persons involved in their health care or payment for health care; and/or disclosures to notify family members or others about the individual's general condition, location or death. The process for handling a patient's request to restrict the use or disclosure of their PHI is outlined in UHS Privacy 21.0 Patient's Rights to Request Use or Disclosure Restrictions and Alternative Communications."
.
Facility document titled "Authorization for Disclosure and use of Protected Health Information" was signed by patient #1 on 12/11/2019. Document indicates that patient did not want information disclosed.
Facility document titled "Aftercare Agency Referral Letter" indicated that the patient #1 medical information was faxed the aftercare facility without the patients' consent.
" Discharge Plan Part 1
" My Recovery/Crisis Safety Plan
" Psychiatric Evaluation
" Last Physician's order
" Aftercare Discharge Plan Part 2
" Discharge Summary
" Advanced Directive/Healthcare Proxy
" Patient Instructions for Home Medications

The finding was confirmed by staff #9 (HIM Director) the afternoon of 2/5/2019.