Failure to Protect Medical Record Confidentiality
Penalty
Summary
The facility failed to protect the confidentiality of medical records for one resident when staff provided the wrong medical record to another resident's representative. Specifically, the record belonging to one resident was given to the representative of another resident, resulting in a breach of privacy. The facility's medical record request process was not followed, and the staff member responsible for the error could not be identified. The information disclosed included sensitive personal details such as social security number and date of birth, as reported by the recipient of the incorrect records. The incident was identified when the facility was notified that a family member had received the wrong medical records. Review of facility policy confirmed that medical records are to be released only in accordance with federal and state privacy laws, and only to authorized individuals. However, in this case, the required procedures were not adhered to, leading to the unauthorized disclosure of protected health information. The event was determined to be an isolated incident, with no evidence of additional residents affected.