HospitalInspections.org

Based on interview and record review, the facility failed to ensure confidential patient information was safeguarded for two of two sampled patients (Patient 1 and Patient 2) when Patient 1 was treated under Patient 2's name. This failure resulted in Patient 1 receiving the wrong physical therapy treatment and Patient 2 having her confidential information provided to another patient.

Findings:

During an interview on 10/28/24 at 12:55 p.m. with Privacy Officer (PO), PO stated on 6/17/24, Rehab Care Coordinator (RCC 1) took a 3-way call from Patient 1's insurance company and Family Member (FM) 1 to schedule a physical therapy session. PO stated Patient 2's information was used to book an appointment for Patient 1 on 6/18/24. PO stated, on 6/18/24, FM 1 showed up at the appointment with Patient 1. RCC 1 presented paperwork to FM 1 with Patient 2's name on it and FM 1 signed it. Staff did not talk to Patient 1 to verify the name and date of birth (DOB). PO stated the Physical Therapy Assistant (PTA) 1 that did Patient 1's physical therapy also did not verify Patient 1's name and DOB. PO stated "It wasn't until further investigation the next day that they [the facility] realized they had given physical therapy to a patient [Patient 1] with the wrong name [Patient 2]." PO stated "We are the verifiers, not the patient." PO stated Patient 1 had not been a patient at the facility before, but Patient 2 had.

During an interview on 10/28/24 at 1:10 p.m. with RCC 1, RCC 1 stated On 6/18/24, she provided FM 1 with Patient 2's information when they arrived for their physical therapy appointment and FM 1 signed it. RCC 1 stated staff never spoke to Patient 1 to verify name or DOB. RCC 1 stated she also scheduled Patient 1 another follow-up appointment using Patient 2's name and gave the information to FM 1. RCC 1 stated she should have spoken to Patient 1 directly and verified identification, name, and DOB. RCC 1 stated, "we should have done better."

During an interview on 10/28/24 at 1:20 p.m. with PTA 1, PTA 1 stated she did physical therapy with Patient 1 on 6/18/24. PTA 1 stated the patient chart she got from the front desk had Patient 2's information and physical therapy evaluation order (PTE). PTA 1 stated she did not ask Patient 1 her name and DOB. PTA 1 stated the PTE was for leg and back pain. PTA 1 stated FM 1 seemed confused and told her "she [Patient 1] is here to do exercises, why aren't you doing that?" PTA 1 stated she thought it was confusing. PTA 1 stated Patient 1 did not speak during the session and "I never check DOB or name, that is up to the front desk staff."

During an interview on 10/28/24 at 2:38 p.m. with Physical Therapy Manager (PTM), PTM stated she was called to the physical therapy department on 6/18/24. PTM stated when she got to the department, she was told the patient was Patient 2. PTM stated FM 1 told her that Patient 1 was just seen in the emergency room (ER). PTM stated that didn't make sense to her because Patient 2's chart did not reflect a recent ER visit. PTM stated it wasn't until the next day that the staff realized they had the wrong chart, and that the real patient was Patient 1 NOT Patient 2. PTM stated "I understand we didn't do our part." PTM stated Patient 1 consented for FM 1 to review her PTE. PTM stated FM 1 was concerned about the date of the evaluation because Patient 1 was admitted in the hospital at that time and didn't have a PTE. PTM stated FM 1 "looked at the evaluation and stated it was incorrect because [Patient 1] was never made to walk and that the evaluation was [made up]." PTM stated she looked in the system and couldn't find that Patient 1 was in the hospital recently. PTA stated after investigating further, it was discovered that the evaluation they were looking at and gave to FM 1 was for Patient 2 not Patient 1. FM 1 then confirmed the wrong name. PTM stated that Patient 1 had never had PT before, and FM 1 was given the wrong evaluation. PTM stated FM 1 went home with Patient 2's paperwork and the facility had to call him and ask him to return the documents.

During a concurrent interview and record review on 10/28/24 at 2:50 p.m. with PO, The PTM, PTA, and RCC 1's, "Statement of Confidentiality/Computer and Information Usage Agreement (SCCIA)," was reviewed. The SCCIA indicated, "[Name of Facility] considers maintaining the security and confidentiality of protected health information a matter of its highest priority. All aspects involving the collection, review, and evaluation of patient/resident care information are confidential. Each person accessing data and resources holds a position of trust relative to this information and must recognize the responsibilities entrusted in preserving the security and confidentiality of this information." The SCCIA was signed by PTM on 5/31/24, PTA 1 on 8/3/20, and RCC 1 on 3/6/18. PO stated that by signing this agreement PTM, PTA 1 and RCC 1 should of not allowed this incident to happen.

During a review of the hospital's policy and procedure (P&P) titled, "Confidential Information," dated 11/29/2011, the P&P indicated, "all information of medical or business nature concerning patients, residents, families, doctors or employees, retained either electronically or on paper, is considered strictly confidential and personal. Under no circumstances will such information be discussed with unauthorized persons either inside or outside [name of hospital]. . . Any unauthorized release of disclosure of confidential information will result in corrective action according to hospital policy and procedure. . . A. Because confidentiality of patient, residents and employee information is so important, it is covered in both the new employee orientation and in yearly re-orientation completed during the employees annual evaluation. . ."