6 Hospitals Fined For Failing to Protect Patient Data
SACRAMENTO, Calif. – The California Department of Public Health (CDPH) announced that six California hospitals and one nursing home have been assessed administrative penalties and fines totaling $792,500 after a determination that the facilities failed to prevent unauthorized access to confidential patient medical information.
“Medical privacy is a fundamental right and a critical component of quality medical care in California,” said Dr. Mark Horton, director of CDPH. “We are very concerned with violations of patient confidentiality and their potential harm to the residents of California.”
The following health facilities received administrative penalties:
1. Biggs Gridley Memorial Hospital, Gridley, Butte County: The hospital was assessed a $5,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by two employees on three occasions.
2. Children’s Hospital of Orange, Orange, Orange County: The hospital was assessed a $25,000 fine after the facility failed to prevent unauthorized access of one patient’s medical information by one employee.
3. Delano Regional Medical Center, Delano, Kern County: The hospital was assessed a $60,000 fine after the facility failed to prevent unauthorized access and disclosure of one patient’s medical information by one employee on three occasions.
4. Kaweah Manor Convalescent Hospital, Visalia, Tulare County: The nursing home was assessed a $125,000 fine after the facility failed to prevent unauthorized access and use of five patients’ medical information by one employee.
5. Kern Medical Center, Bakersfield, Kern County: The hospital was assessed a $60,000 fine after the facility failed to prevent unauthorized access and disclosure of one patient’s medical information by two employees on three occasions.
6. Kern Medical Center, Bakersfield, Kern County: The hospital was assessed a $250,000 fine after the facility failed to prevent the theft of 596 patients’ medical information.
7. Oroville Hospital, Oroville, Butte County: The hospital was assessed a $42,500 fine after the facility failed to prevent unauthorized disclosure of one patient’s medical information by one employee on two occasions.
8. Pacific Hospital of Long Beach, Long Beach, Los Angeles County: The hospital was assessed a $225,000 fine after the facility failed to prevent unauthorized access and use of nine patients’ medical information by one employee.
CDPH has assessed the penalties to these facilities under new legislation intended to protect the confidentiality of medical records. CDPH has determined that the hospitals failed to prevent unauthorized access to patient medical information, as required by Section 1280.15 of the Health and Safety Code. The penalties on this release are the first of their kind issued to each of these facilities.
An administrative penalty of $25,000 may be assessed against a medical facility for the breach of each patient’s medical information. A penalty of up to $17,500 is added for each subsequent breach of each patient’s medical information.
Facilities are required to submit a plan of correction to CDPH within 10 working days and implement a plan of correction to prevent future incidents. Facilities can appeal an administrative penalty by requesting a hearing within 10 calendar days of notification. If a hearing is requested, the penalties are to be paid if upheld following appeal.
All hospitals in California are required to be in compliance with applicable state and federal laws and regulations governing general acute care hospitals. The hospitals are required to comply with these standards to ensure quality of care.
In 2008, Governor Arnold Schwarzenegger signed legislation, SB 541 and AB 211, to improve patient privacy laws and to address breaches of confidential information.
SB 541 by Senator Elaine Alquist (D-Santa Clara) sets health facility fines for privacy breaches and increases the fines for serious medical errors in hospitals. The new law ensured that health care providers face real consequences when they fail to protect patients. For facilities, fines for disclosing private medical information range up to $250,000 per reported event.
AB 211 by Assemblymember Dave Jones (D-Sacramento) requires health providers to prevent unlawful access, use or disclosure of patients’ medical information and hold health care providers and other individuals accountable for ensuring the privacy of patients.
Related articles:
- How the HITECH Act May Affect Your Healthcare Facility
- ‘How Safe Is Your Campus?’ Survey Results: Hospitals
- Did Your Hospital Pass the Security Stress Test?
If you appreciated this article and want to receive more valuable industry content like this, click here to sign up for our FREE digital newsletters!
Related Content
Leading in Turbulent Times: Effective Campus Public Safety Leadership for the 21st Century
This new webcast will discuss how campus public safety leaders can effectively incorporate Clery Act, Title IX, customer service, “helicopter” parents, emergency notification, town-gown relationships, brand management, Greek Life, student recruitment, faculty, and more into their roles and develop the necessary skills to successfully lead their departments. Register today to attend this free webcast!
