HospitalInspections.org

Based on review of document and staff interview, it was determined that the hospital did not ensure the confidentiality of patient records. Specifically, the hospital released copies of the patient's medical records information to an unauthorized individual.

Findings include:

Review of Patient A's medical record, identified that no next of kin was listed.
Interview with Staff #1 and review of documents identified the following: Patient's ex-wife submitted an Authorization to Disclose Protected Health Information/Medical Record, requesting portions of his medical record.
This request was received by hospital contracted service for release of information vendor on June 8, 2015.
The request was denied and an invalid authorization notice was sent to the ex-wife, stating the reason for the denial by the vendor.
The ex-wife resubmitted the medical record request with a notarized affidavit dated 6/20/15, which states that she is the beneficiary of Patient A on a life insurance policy and therefore, was requesting the medical record for insurance purposes. This was received by hospital vendor on July 24, 2015.
After receiving the request, the vendor released the medical records to the ex-wife.
The hospital policy and procedure titled, "Confidentiality and Release of Information (ROI) from the Medical Record," revised June 2014, stated the following: " When completing the authorization where required, the authorization should be completed in full and signed by the patient or authorized representative. When the patient is deceased, please note a copy of death certificate will be required to verify that patient is deceased when he or she did not expire in our facility as well as to establish the next of kin. The signature must be the next of kin or legal representative (e.g. executor/executrix) along with letters of administration establishing that status, or the distributees of a deceased subject for whom a personal representative has not been appointed or from the holder of a power of attorney from such distributee.
The hospital did not verify that the person requesting the medical record information of the decedent is the next of kin or legal representative as per the hospital policy. The hospital released the medical record to the decedent's ex-wife, who was not the next of kin or the legal representative.