Monterey County County Administrative Office LEW C. Bauman*

R1

Natividad Medical Center share its IT Department model with other county hospitals as a standard of excellence when appropriate at all upcoming opportunities. Response to R1: The Board agrees with this Recommendation. NMC's IT Department regularly collaborates with all hospital IT departments within Monterey County including the recent formation of Central Coast Health Connect, the regional Health Information Exchange (HIE). We will continue to share our IT expertise with our colleagues. NMC is a member of the California Association of Public Hospitals and Health Systems (CAPH) representing the 21 California public health care systems which are the core of the state's health care safety net. Since 1999, the California Health Care Safety Net Institute (SNI), serving the members of CAPH, has helped public health care systems develop and spread innovative programs to help improve the quality of patient care and care coordination, enhance efficiencies, and eliminate health care disparities. NMC IT leadership has recently joined a new SNI collaboration to standardize IT processes of its members. The group had its kick off meeting in May and will be meeting regularly. We will collaborate and share our knowledge.

R2

Natividad Medical Center immediately review and ensure that its notices to the public about HIPAA breaches are written in languages commonly understood by the impacted person. Response to R2: The recommendation has been implemented. On June 26, 2015 NMC reviewed its notices to the public about privacy breaches process to ensure the notice is written in a language commonly understood by the impacted person. Upon admission each patient is asked their preferred language and this is documented in the medical record. NMC uses this information to draft the privacy breach notification in the appropriate language including or to determine if any sight translation may be required. In the development of the interpretation program, NMC patient demographics were studied and it was found that there were sixty (60) languages spoken in the service area including indigenous- languages, primarily Triqui, Mixteco, Zapoteco and Chatino all native to Oaxaca, Mexico. The study also found fifty percent (50%) of the patient population spoke English, forty-seven percent (47%) spoke Spanish and three percent (3%) spoke one of at least fifty-eight (58) other languages. NMC is in full compliance with the California Health and Safety Code §1259 requiring NMC to provide language assistance services for language groups that comprise five percent (5%) or more of the facility population. NMC exceeds the regulation with interpreter services available 24 hours a day to all patients even if less than five percent and if a document requires translation there are interpreters readily available to either translate the document in written form or to provide sight translation.

R3

Natividad Medical Center continue to improve and update best practices for secure physical delivery of PHI documents to other healthcare providers and individual patients while awaiting an active HIE for secure transmittals. Response to R3: The recommendation has been implemented. Investigations of privacy breaches during the calendar year 2015 reveal privacy breaches are related to documents being printed for delivery to the patient. For example, discharge instructions, receipts for payment, and prescriptions that are labeled with incorrect label or an incorrect document is given to a patient or their representative. Based on these findings NMC has taken the following actions over the past four months to implement best practices and mitigate future breaches: 1. Printing of discharge instructions has been restricted in the Emergency Department to Registered Nurses staff only. 2. The medial staff has been encouraged to use only electronic prescription rather than hand written ones that require a patient label. 3. The nursing staff have been instructed to use two patient identifiers (patient name and date of birth) for care and treatment of patients that include the review of discharge instruction documents. 4. The nursing staff in the Emergency Department has been instructed to check each document as it is removed from the printer to ensure another patient's document did not print in the middle of the print job. 5. The staff who receives payments have been educated to verify the patient name and credit card number (when appropriate) prior to providing a receipt. NMC will continue to investigate the root cause of each privacy breach and determine the corrective action to prevent future re-occurrence, including research to improve and update best practices for secure physical delivery of PHI documents. File ID 15-0788 No. Monterey County 168 West Alisal Street, 1st Floor Salinas, CA 93901 Board Order 831.755.5066 Upon motion of Supervisor Parker, seconded by Supervisor Potter and carried by those members present, the Board of Supervisors hereby: a. Approved the response to 2014-2015 Monterey County Civil Grand Jury Interim Final Report No. 12 "Information Security at Natividad Medical Center: A Model of Best Practices"; and b. Directed the County Administrative Officer to file the approved response with the Presiding Judge of the Superior Court, County of Monterey, by September 11, 2015. PASSED AND ADOPTED on this 28th day of July 2015, by the following vote, to wit: Supervisors Armenta, Phillips, Salinas, Parker and Potter AYES: NOES: None ABSENT: None I, Gail T. Borkowski, Clerk of the Board of Supervisors of the County of Monterey, State of California, hereby certify that the foregoing is a true copy of an original order of said Board of Supervisors duly made and entered in the minutes thereof of Minute Book 78 for the meeting on July 28, 2015. Gail T. Borkowski, Clerk of the Board of Supervisors Dated: August 1, 2015 County of Monterey, State of California File ID: 15-0788 By Danise Hancock