HospitalInspections.org

Based on interview and record review, the facility's Governing Body failed to:

1. Effectively carry out their role and responsibility to provide a safe and secure environment for patients in the WHC ORs when:
a. Hospital leadership did not provide notification of a potential investigation and the use of video recording during medical treatment without patient's consent;
b. Hospital leadership did not allow:
1) The Board's participation in the selection of qualified staff to conduct the investigation of alleged missing medication;
2) Utilization of the Pharmacy Department's Policy and Procedure to investigate alleged missing medications;
c. Hospital leadership did not ensure investigation participants were trained to protect patient confidentiality.
d. Hospital leadership did not provide an initial or on-going status reports to the Medical Executive Committee until the conclusion of the covert investigation was presented;
e. The hospital wide grievance process was not followed when patients in the WHC ORs became aware they had been video recorded during a medical treatment without their consent. (Refer to A-0049)

2. Ensure the Medical Executive Committee received restraint use data analysis. (Refer to A-0049)


The cumulative effect of these systemic problems resulted in the Hospital's failure to deliver care in compliance with the Condition of Participation for Governing Body and failure to provide a safe environment for patients.

Based on interview and record review, the facility's Governing Body failed to:

1. Effectively carry out their role and responsibility to provide a safe and secure environment for patients in the WHC ORs when:
a. Hospital leadership did not provide notification of a potential investigation and the use of video recording during medical treatment without patient's consent;
b. Hospital leadership did not allow:
1) The Board's participation in the selection of qualified staff to conduct the investigation of alleged missing medication;
2) Utilization of the Pharmacy Department's Policy and Procedure to investigate alleged missing medications;
c. Hospital leadership did not ensure investigation participants were trained to protect patient confidentiality.
d. Hospital leadership did not provide an initial or on-going status reports to the Medical Executive Committee until the conclusion of the covert investigation was presented;
e. The hospital wide grievance process was not followed when patients in the WHC ORs became aware they had been video recorded during a medical treatment without their consent.

2. Ensure the Medical Executive Committee received restraint use data analysis.

As a result, health information was disclosed, the hospital leadership had the potential to be unaware of all patient grievances related to the disclosure of patient health information, and there was potential for unsafe use of restraint and seclusion.

Findings:

1. On 4/4/19 at 2:30 P.M., the ODO stated in June 2012, "a covert investigation" was initiated at the direction of the then CEO and COO related to a suspected person(s) stealing drugs from the Women Centers ORs (covert). The investigation was intentionally limited to selected members of the Hospital Leadership (CEO, COO), the System Director of Security and Parking Services, and an IS Technician, a Background Investigator, the ODO, the WHC Supervisor, and the Director of the WHC. The covert investigative team decided to install motion activated cameras in all three Women Centers ORs. These cameras were installed by IS and were located in the anesthesia cart computer monitors. As part of the installation, the camera "ON" indicator lights were disabled, to prevent anyone recognizing the computer was recording. Per the ODO, the purpose of the motion activated cameras was to video record any staff member accessing the anesthesia medication cart. In addition, the ODO stated, only of the members of the covert investigative team were aware of the camera presence and their ability to record.

The job description of the ODO assigned to the covert investigation dated and signed on 10/27/09, was reviewed on 4/16/19. The ODO's primary responsibility was to provide security services to areas of high risk security situations. The ODO stated his assigned area was the hospital emergency room. His training did not include facility investigations involving missing medications, or video recording of patients undergoing medical treatment.

On 4/16/19 at 11:18 A.M., an interview was conducted with the ODO. The ODO did not recall being trained and informed about standards for medical privacy. He stated he showed selected video recordings to the WHC Supervisor and eventually presented his conclusion of his covert investigation to the MEC on 4/10/13. After the ODO's presentation to MEC, the video recordings continued without modification until 6/30/13.

On 4/4/19, at 4:30 P.M., the COS was interviewed. The COS was informed by the CEO after the covert investigation had been going on for "several months." The COS stated the MEC was not made aware of any information related to missing medication or video recording in the WHC ORs until the suspected MD was identified. An emergency MEC meeting was called on 4/10/13. The ODO presented to the MEC the results of the covert investigation which included the MEC viewing selected video recordings.

A telephone interview was conducted on 4/8/19 at 3:05 P.M., with the PIC. The PIC stated when medication(s) were missing, Pharmacy was involved. She further stated, whether the medication was controlled or uncontrolled the information was reported to additional authorities. The PIC was made aware two weeks after her hire in April 2013, by the CEO and COO at the time, of their concerns regarding a physician diverting medication. The CEO and COO asked for recommendations from the PIC, the PIC asked for more detailed information of the investigation. However, the CEO and COO did not provide any details except to state the issues were still under investigation.

An interview with the current COO was conducted on 4/22/19 at 4:25 P.M. The COO stated the Department of Pharmacy had a very methodical system to investigate missing medication(s) and they let the facts direct the investigation. He further stated the Department of Pharmacy should have been involved.

A record review was conducted on 4/24/19. According to the Department of Pharmacy's Policy and Procedure entitled, Drug Storage/Security dated 4/09, "C. Drugs stored within the pharmacy and throughout the hospital will be secure and must be under the control of the pharmacy department." In addition, the Department of Pharmacy has a process to investigate missing medications. During the same interview conducted on 4/16/19 at 11:18 A.M., the ODO stated, due to the camera locations (inside the monitor), everything within the camera's field of view was recorded. Once activated the cameras recorded everything, which included staff, physicians, and patients undergoing medical treatment.

During the same interview conducted with the ODO on 4/16/19 at 11:18 A.M., the ODO stated, the covert investigation continued from 7/13/12 through 6/30/13 recording all activity within the three Women Centers ORs.

According to the ODO, the video recordings were initially stored on each OR's individual computer HD. The ODO could request specific video recordings through the Security Director and IS. These video recordings were transferred to a portable TD (TD 1), which the ODO viewed and maintained possession of. At the conclusion of the covert investigation, the three OR computer HDs, containing all video recordings, were removed and the video recordings were transferred to an external HD which the ODO maintains possession of.

The covert investigative team determined the document entitled Admission Agreement for Inpatient and Outpatient Services dated (rev 6/4/2010), "1. General Consent to Hospital Services: You consent to ...and to the taking of photographs and videos of you for medical treatment, scientific, education, quality improvement, safety, identification or research purposes, at the discretion of the hospital and your caregivers and as permitted by law...", allowed the hospital to conduct the covert investigation including video recording of patients undergoing medical treatment.

A second TD (TD 2), containing multiple video clips including 14 patients undergoing medical treatment,
was prepared by the ODO per the request of a third party. On 4/17/19 at 9:45 A.M., the AGC was interviewed. According to the AGC, the information released to the third party was not reviewed by anyone other than the ODO. The facility did not ensure the information released did not include any health information.

A record review was conducted on 4/16/19. On 6/5/13, the facility CMO received a letter from the third party stating, they had received, "...2. Copies of evidence..., including a DVD containing the un-redacted version of the video the Hospital has referenced regarding ..."

A record review was conducted on 4/16/19. On May 20, 2016 (three years later), the facility sent a certified letter, informing 14 patients, "...[the facility] recently learned that your health information was accidentally and unintentionally disclosed to [the third party]...[the facility's legal department] erroneously provided [the third party] with a flash drive that contained video (no audio) which included images of you taken during a medical procedure you had at [the facility] on [date]...Please contact [CNO] at [phone number] if you require further information."

According to the hospital's policy and procedure entitled, Patient Complaint Management/Grievance Process Hospitals, Home Care and Hospice, dated 2/2018, "Purpose: To define guidelines for communication and resolution of customer dissatisfaction with services...Policy A. The governing bodies of each hospital entity delegates to the patient relations department and leadership at each facility the duty to identify those representatives appropriate to function as a grievance committee to address each specific complaint or grievance received...3. All Complaints and Grievances that involve a concern over the privacy or protection of an individual's protected health information (PHI) shall be promptly reported to [the facility's] Privacy Officer....H. An electronic database is used to record Complaints and Grievances...2. Findings and the resolution of the grievance shall be documented and retained for a period of three (3) years for Review by authorized parties such as the California Department of Public Health...Privacy complaint records will be retained for six (6) years."

On 4/15/19 at 4:15 P.M., an interview was conducted with the VPFSS, MPR, and the DRA. According to the MPR, the letter sent to the 14 patients involved in the possible health information disclosure, were directed to contact the Vice President of Patient Care (aka the CNO), for further information. The DRA further stated all calls from the patients involved in the video recordings were invited to respond back directly to the CNO, and was unsure if the issues were resolved. The MPR stated the CNO may have received 2-3 responses out of the 14 patients notified of the possible health information disclosure. The DRA stated, the 14 patients were intentionally not included in the patient relations process and database due to the "sensitive" nature of the incidents for their community members. In addition, the MPR further stated, any patient who now calls regarding the video recording only speak to her. The MPR was directed to eliminate patients who were not provided care during the time frame and location of the video recordings. The MPR was further directed to forward any patients who met the investigation time frame, to the hospital's legal counsel immediately.

2. On 4/15/19 at 3:03 P.M., the DRA was interviewed regarding restraint and seclusion data for the hospital. On 4/16/19, the DRA provided a dashboard report on restraint and seclusion for the BHU, however, there was no dashboard report on restraint and seclusion for any other areas within the hospital. According to the DRA, there was only unit specific data collection, but no hospital wide analysis of restraint and seclusion usage. The DRA further stated, the MEC only received information on reportable incidents, such as deaths related to restraint and seclusion usage.

On 4/24/19 at 9:30 A.M., the CEO stated, although data was collected at the unit level, it had not been analyzed and reported to the Quality and Safety Committee or the Board. The CEO stated he recognized there should be PI projects, "but we don't see this happening."

Based on interview and record review, the hospital failed to protect and promote each patient's rights when:

1. The hospital leadership allowed video recording without the consent of patients undergoing medical treatment (Refer to A-0143);
2. The hospital disclosed health information of 14 patients to a third party (Refer to A-0147);
3. The hospital did not have a hospital wide process to analyze restraint and seclusion usage (See A-0154);
4. The hospital did not follow their grievance policy and procedure regarding the disclosure of health information to a third party (See A-0118).

The cumulative effect of these systemic problems resulted in the Hospital's failure to deliver care in compliance with the Condition of Participation for Patient Rights and failure to provide a safe and secure environment for patients.

Based on interview and record review, the hospital failed to follow their grievance policy and procedure regarding the disclosure of health information for 14 out of 14 (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14), patients to a third party.

As a result, the hospital leadership had the potential to be unaware of all patient grievances related to the disclosure of patient health information.

Findings:

The hospital's policy and procedure entitled, Patient Complaint Management/Grievance Process Hospitals, Home Care and Hospice, dated 2/2018, was reviewed. "Purpose: To define guidelines for communication and resolution of customer dissatisfaction with services...Policy A. The governing bodies of each hospital entity delegates to the patient relations department and leadership at each facility the duty to identify those representatives appropriate to function as a grievance committee to address each specific complaint or grievance received...3. All Complaints and Grievances that involve a concern over the privacy or protection of an individual's protected health information (PHI) shall be promptly reported to [the facility's] Privacy Officer....H. An electronic database is used to record Complaints and Grievances...2. Findings and the resolution of the grievance shall be documented and retained for a period of three (3) years for Review by authorized parties such as the California Department of Public Health...Privacy complaint records will be retained for six (6) years."

On 4/17/19 at 9:45 A.M., the AGC was interviewed. According to the AGC, a TD (TD 2), containing multiple video clips including 14 patients undergoing medical treatment, was prepared by the ODO per the request of a third party. The information released to the third party was not reviewed by anyone other than the ODO. The facility did not ensure the information released did not include any patients' health information.

On 6/5/13, the facility CMO received a letter from the third party stating, they had received, "...2. Copies of evidence..., including a DVD containing the un-redacted version of the video the Hospital has referenced regarding ..."

On May 20, 2016 (three years later), the facility sent a certified letter, informing 14 patients, "...[the facility] recently learned that your health information was accidentally and unintentionally disclosed to [the third party]...[the facility's legal department] erroneously provided [the third party] with a flash drive that contained video (no audio) which included images of you taken during a medical procedure you had at [the facility] on [date]...Please contact [CNO] at [phone number] if you require further information."

On 4/15/19 at 4:15 P.M., an interview was conducted with the VPFSS, MPR, and the DRA. According to the MPR, the letter sent to the 14 patients involved in the possible health information disclosure, were directed to contact the Vice President of Patient Care (aka the CNO), for further information. The DRA further stated all calls from the patients involved in the video recordings were invited to respond back directly to the CNO, and was unsure if the issues were resolved. The MPR stated the CNO may have received 2-3 responses out of the 14 patients notified of the possible health information disclosure. The DRA stated, the 14 patients were intentionally not included in the patient relations process and database due to the "sensitive" nature of the incidents for their community members. In addition, the MPR further stated, any patient who now calls regarding the video recording only speak to her. The MPR was directed to eliminate patients who were not provided care during the time frame and location of the video recordings. The MPR was further directed to forward any patients who met the investigation time frame, to the hospital's legal counsel immediately.

Based on interview and record review, the hospital failed to ensure the privacy of all patients undergoing medical treatment in the WHC ORs when the hospital's Admission Agreement for Inpatient and Outpatient Services was utilized as consent to allow video recording during medical treatment. Also, the Admission Agreement did not allow the patients' the option to acknowledge and/or decline video recording.

As a result, the hospital leadership allowed video recording of patients undergoing medical treatment without knowledge or consent.

Findings:

During an interview with PASR 1 on 4/15/19 at 11:55 A.M., PASR 1 stated the Admission Agreement for Inpatient and Outpatient Services document, was the patient's consent for treatment. PASR 1 stated, most patients' do not read the consent form and sign the document. PASR 1 did not recall patients' asking any questions related to "1...to the taking of photographs and videos of you for medical treatment..."

PASR 4 was interviewed on 4/15/19 at 12 Noon. PASR 4 stated the Admission Agreement for Inpatient and Outpatient Services document is a document that cannot be modified.

A review of the Admission Agreement for Inpatient and Outpatient Services dated 2012, was conducted on 4/17/19. The terms contained in the document "1...photographs and videos of you for medical treatment..." was not specifically defined for patients on this consent. The form did not allow space for patients to list any limitations to being photograph or being video recorded at the facility.

On 4/4/19 at 2:30 P.M., the ODO stated in June 2012, a "covert" investigation was initiated at the direction of the then CEO and COO related to a suspected person(s) stealing drugs from the Women Centers ORs. The investigation was intentionally limited to selected members of the Hospital Leadership (CEO, COO), the System Director of Security and Parking Services, and an IS Technician, a Background Investigator, the ODO, the WHC Supervisor, and the Director of the WHC. The covert investigative team decided to install motion activated cameras in all three Women Centers ORs. These cameras were installed by IS and were located in the anesthesia cart computer monitors. As part of the installation, the camera "ON" indicator lights were disabled, to prevent anyone recognizing the computer was recording. Per the ODO, the purpose of the motion activated cameras was to video record any staff member accessing the anesthesia medication cart. In addition, the ODO stated, only of the members of the covert investigative team were aware of the camera presence and their ability to record.

The covert investigative team determined the document entitled Admission Agreement for Inpatient and Outpatient Services dated (rev 6/4/2010), "1. General Consent to Hospital Services: ...you consent to ...and to the taking of photographs and videos of you for medical treatment, scientific, education, quality improvement, safety, identification or research purposes, at the discretion of the hospital and your caregivers and as permitted by law...", allowed the hospital to conduct the covert investigation including video recording of patients undergoing medical treatment.

Based on interview and record review, the hospital failed to ensure the confidentiality of 14 of 14 sampled patients (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12 ,13, 14), when health information (video recordings in the WHC ORs), was disclosed to a third party.

As a result, 14 patients had their health information viewed by a third party, without the patients' knowledge or consent.

Findings:

On 4/4/19 at 2:30 P.M., the ODO stated in June 2012, "a covert investigation" was initiated at the direction of the then CEO and COO related to a suspected person(s) stealing drugs from the Women Centers ORs. The covert investigative team decided to install motion activated cameras in all three Women Centers ORs. These cameras were installed by IS and were located in the anesthesia cart computer monitors. Per the ODO, the purpose of the motion activated cameras was to video record any staff member accessing the anesthesia medication cart.

According to the hospital's policy and procedure entitled, Health Information - Access, Use and Disclosure dated 11/2012, "3 F 3. a...Disclosure of Protected Health Information for any reason other than the categories above requires patient/legal representative authorization."

On 4/17/19 at 9:45 A.M., the AGC was interviewed. According to the AGC, a TD (TD 2), containing multiple video clips including 14 patients undergoing medical treatment, was prepared by the ODO per the request of a third party. According the AGC, the information released to the third party was not reviewed by anyone other than the ODO. The facility did not ensure the information released did not include images of patients' undergoing medical treatment.

On 6/5/13, the facility CMO received a letter from the third party stating, they had received, "...2. Copies of evidence..., including a DVD containing the un-redacted version of the video the Hospital has referenced regarding ..."

On May 20, 2016 (three years later), the facility sent a certified letter, informing 14 patients, "...[the facility] recently learned that your health information was accidentally and unintentionally disclosed to [the third party]..."

On 4/15/19 at 4:15 P.M., MPR acknowledged the facility notified 14 patients of a possible breach of health information.

Based on interview and record review, the hospital failed to ensure a hospital wide process to analyze restraint and seclusion usage.

As a result, there was the potential for unsafe use of restraint and seclusion.

Findings:

On 4/15/19 at 3:03 P.M., the DRA provided unit specific restraint and seclusion checklist(s) for review. The DRA stated, there was no data complied and analyzed with the unit specific checklist results.

On 4/16/19 at 11:30 A.M., an interview was conducted with the DRA. The DRA provided a dashboard report on restraint and seclusion for the BHU during the time period of FY 18-19 Qtr 2, however, there was no dashboard report on restraint and seclusion for any other units within the hospital. According to the DRA, there was only unit specific data collection, but no hospital wide analysis of restraint and seclusion usage. The DRA further stated, the MEC only received information on reportable incidents, such as deaths related to restraint and seclusion usage.

On 4/24/19 at 9:30 A.M., the CEO stated, although restraint and seclusion data was collected at the unit level, it had not been analyzed and reported to the Quality and Safety Committee or the Board. The CEO stated he recognized there should be PI projects. The CEO further stated, PI projects for restraints and seclusion were not identified.