HospitalInspections.org

Based on Interview and record review, the facility failed to ensure all confidential patient information was protected. As a result, Employee 1 obtained unauthorized copies of clinical and facility records that contained PHI for 78 different patients. A portion of the PHI was obtained by Employee 1 after his last day worked.

Findings:

On October 29, 2009, and April 2 and 27, 2010, unannounced visits were made to the facility for a complaint investigation.

On October 29, 2009, the file for Employee 1, (a lab tech), was reviewed. Employee 1 was hired by the facility on May 1, 2001. His last day worked was August 7, 2009, and he was terminated from employment on August 24, 2009.

On November 2, 2009 the CDPH, L&C, RDO, received a packet of information from employee 1, via USPS. In the packet was a letter from Employee 1 indicating he enclosed documents that supported a complaint he filed against the facility.

On February 24, 2010, the documents contained in the packet from Employee 1 were reviewed. The documents contained portions of the clinical records, and facility reports, for 78 different patients. In addition, there was a copy of a letter, dated August 5, 2009, to the facility Director of Labor Relations, from a Union Representative. This letter requested copies of any and all information being used by the facility, including the names of patients, dates, and times of each incident showing the time changes of lab draws. There were billing and lab inquiries, copies of lab labels, lab results, and a phlebotomy report. The PHI contained in these documents was as follows:

a. Patient name, account #, MR #, and labs drawn for Patient 501;

b. Patient names for Patient's 502 through 552;

c. Patient name, account #, MR #, DOB, and types of labs drawn for Patients 553, 554, 555, 556, and 557; and

d. Account #, MR #, DOB, lab results, and Billing Inquiries for Patients 558, 559, 560, 561, 562, 563, 564, 565, 566, 567, 568, 569, 570, 571, 572, 573, 574, 575, 576, 577, and 578.

On April 2, 2010, at 11 a.m., the Director of HR was interviewed. She stated when a request for information came in from an employee or Union Rep, the request was given to the employee's supervisor. She further stated HR did not have access to patient's clinical records, and no patient information was ever given out from HR.

On April 2, 2010, at 11:40 a.m., the Lab Supervisor was interviewed. He stated if a request came to him from an employee or Union Rep for information being used in a grievance hearing, he would first make sure there was no confidential patient information on any of the documents, and black it out if there was. In addition, the Lab Supervisor stated no portion of the clinical record should be copied and taken from the facility, but there was no way of knowing if it did happen. He stated Lab techs had access to patient records, but should only access what was necessary to perform their job. The Lab Supervisor stated there was no system to alert the facility if an employee was accessing any part of the medical record that was not necessary to perform their job, and the only way the facility tracked unauthorized access was when another employee alerted the supervisor of a possible violation.

On April 2, 2010, the facility policy titled, "Uses and Disclosures of Protected Health Information", revised in May 2005, was reviewed. The policy indicated, "It is the policy of Hemet Valley Medical Center to protect the privacy of individual patient health information. Because of this, the amount of information accessible in response to a request for information is limited to the minimum amount needed to perform a specific type of work or to complete a function."

On April 2, 2010, the information provided to all employees regarding HIPAA and PHI was reviewed. The information indicated PHI included medical records and any other individually identifiable health information used or disclosed for treatment, payment, or health care operations. Examples of PHI were name, birth date, medical record number, and account number.

On April 27, 2010, at 10:15 a.m., the documents provided to CDPH by Employee 1, were reviewed with the Director of HR, the Director of HIM, and the Lab Supervisor. In a concurrent interview with the Lab Supervisor he indicated the following:

a. The "Lis Billing Inquiry," was a retrospective review he used. He stated the lab techs did not have a need to access this report. He reviewed a random sample of the Billing Inquiries received from Employee 1. He stated the Billing Inquiry for Patient 501 indicated Employee 1 accessed and printed this report on June 14, 2009. The other Billing Inquiry's indicated the Lab Supervisor accessed and printed the reports on August 24, 2009. The Lab Supervisor stated he did not give a copy of these reports to Employee 1, and did not know how Employee 1 got a copy of them. He further stated, these reports should not have left the facility because even though the patient names had been blacked out, the report still contained private information, such as account #, MR #, and type of labs done.

b. The " Phlebotomy Collection Report " , indicated all labs drawn on July 19, 2009, and was printed on September 18, 2009, (42 days after Employee 1's last day worked). The Lab Supervisor stated the report was used at a grievance hearing for Employee 1, to show cause for disciplinary action against the employee. The report contained the names of Patient's 502 through 552. The Lab Supervisor stated he did not know how Employee 1 got a copy of the report. He further stated this report should not have left the facility because it contained patient names.

c. The lab labels were printed on September 19, 2009, and contained the patient names, acct #, MR #, DOB, and type of labs done for Patients 553 through 557. The Lab Supervisor stated he did not know who printed these labels, or how Employee 1 got a copy of them.

d. The top sheet indicating "What", "Why", and "Reason", and stamped as received by HR on September 30, 2009, was a form used by Employee 1 at his Grievance Hearing. Stapled to the top sheets were Patient records and facility reports that contained the account #, MR #, DOB, lab results, and Billing Inquiry for Patient's 558 through 578. The Lab Supervisor stated he did not know how Employee 1 got a copy of the records.

On April 27, 2010, at 10:40 a.m., during an interview with the Director of HR, she stated, Employee 1 came to the Grievance Hearing with the top sheets only, and did not have any of these facility documents, or patient records with him at that time. The Director of HR stated she did not know how Employee 1 received copies of these documents.

On April 27, 2010, at 10:50 a.m., during an interview with the Director of HIM, she stated the request for this information was not brought to her attention. She stated when copies were made by the facility, all patient's PHI would be redacted (blacked out) prior to the documents being released. The Director of HIM stated she did not know how Employee 1 was able to obtain copies of patient records and facility documents that contained patient PHI, not only while he was employed by the facility, but after his last day of employment as well, and then remove the documents from the facility.

Based on interview and record review, the facility failed to ensure staff and physicians refrained from using PRN restraint orders for one of four patients in restraints (Patient 107). This failed practice resulted in the potential for Patient 107 to be restrained unnecessarily in violation of her rights.

Findings:

The record for Patient 107 was reviewed on April 28, 2010. Patient 107, an 88 year old female, was admitted to the facility on April 23, 2010, with diagnoses that included abdominal pain with a possible bowel obstruction.

The patient became agitated on April 26, 2010, and a telephone order for, " wrist restraints as needed, " was written by RN 10 at 4:30 p.m. The order did not indicate the type of restraint, the reason for the restraint, the duration of the restraint, or the criteria for releasing the restraint.

The restraint flow sheet indicated Patient 107 was in restraints on April 26, 2010, at 8 p.m. and 10:07 p.m., and on April 27, 2010, at midnight, 2 a.m., 4 a.m., 6 a.m., and 8 a.m. There was no indication what type of restraints were in place or why the patient was in restraints.

A new order for bilateral (both sides) wrist restraints was written on April 27, 2010, at 9 a.m.

During an interview with RN 10 on April 27, 2010, at 11:50 a.m., the RN stated on April 26, 2010, at 4:30 p.m., she received a verbal order from the physician for Patient 107 to be restrained, " as needed, " and she wrote the order. She stated she did not complete a facility specific restraint order form.

Based on record review, the facility failed to ensure 10 of 10 patients receiving anesthesia services (Patients 108, 109, 112, 208, 209, 210, 211, 212, 401, and 402) had an appropriate post anesthesia assessment performed that included assessment of respiratory function, cardiovascular function, mental status, temperature, pain, nausea and vomiting, and postoperative hydration, by the person performing the anesthesia services. This failed practice resulted in the potential for complications from anesthesia to go undetected, and patients to suffer harm or death.

Findings:

1. The record for Patient 108 was reviewed on April 28, 2010. Patient 108, a 37 year old female, underwent a repeat c-section on February 23, 2010, with spinal anesthesia.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.

2. The record for Patient 109 was reviewed on April 28, 2010. Patient 109, a 28 year old female, underwent a c-section on March 2, 2010, with spinal anesthesia.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.

3. The record for Patient 112 was reviewed on April 28, 2010. Patient 112, a 26 year old female, underwent a c-section on January 22, 2010, with spinal anesthesia.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.



18918

4. The record for Patient 208 was reviewed on April 28, 2010. Patient 208, a 40 year old female, underwent a bilateral tubal ligation, under general anesthesia, on March 10, 2010.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.

5. The record for Patient 209 was reviewed on April 28, 2010. Patient 209, a 43 year old female, underwent a repeat cesarean section, under spinal anesthesia, on March 22, 2010.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.

6. The record for Patient 210 was reviewed on April 28, 2010. Patient 210, a 25 year old female, underwent an exploratory laporatomy, under general anesthesia, on March 1, 2010.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.

7. The record for Patient 211 was reviewed on April 28, 2010. Patient 211, a 26 year old female, underwent umbilical hernia repair, under general anesthesia, on March 29, 2010

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.

8. The record for Patient 212 was reviewed on April 28, 2010. Patient 212, a 31 year old female, underwent a repeat cesarean section, under spinal anesthesia, on January 24, 2010.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.



25624

9. The record for Patient 401 was reviewed on April 28, 2010. Patient 401, a 67 year old female, underwent an appendectomy with general anesthesia on March 16, 2010.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.

10. The record for Patient 402 was reviewed on April 28, 2010. Patient 402, a 37 year old female, underwent a c-section with general anesthesia on March 22, 2010.

According to the anesthesia record, the postoperative evaluation done by the anesthesiologist included an assessment of the LOC, cardiopulmonary (heart and lung) status, complications, and follow up care needed.

The evaluation did not include an assessment of the temperature, pain, nausea and vomiting, or postoperative hydration.

According to the American Society of Anesthesiologists, Practice Guidelines for Post Anesthesia Care, March 2002, routine postanesthesia assessment and monitoring should include the following:

a. respiratory function, including respiratory rate, airway patency, and oxygen saturation;

b. cardiovascular function, including pulse rate and blood pressure;

c. mental status;

d. temperature;

e. pain;

f. nausea and vomiting; and,

g. postoperative hydration.

These 10 patients did not receive an appropriate postoperative anesthesia assessment.