UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: LVQ011, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to maintain the confidentiality of protected health information when the following occurred:1. Patient xxxxxxx consultation letter was faxed to the wrong provider; 2. Patient xxxxxxx After Visit Summary was handed to an incorrect patient; 3. Patient xxxxxxx consultation letter was faxed to the wrong provider;4. Patient xxxxxxx consultation letter was faxed to the wrong provider; 5. Patient xxxxxxx Discharge Summary was faxed to the wrong provider;6. Patient xxxxxxx Surgical Pathology Report was emailed to an incorrect patient; 7. Patient xxxxxxx consultation letter was faxed to the wrong provider;8. Patient xxxxxxx MRSA (Methcillin Resistant Staphylococcus Aureus) Notice was mailed to the incorrect patient; and 9. Patient xxxxxxx progress notes were faxed to persons at a private residence. These mistakes in the handling of patients' confidential information had the potential to be embarrassing for the patient and posed a threat for identity theft.Findings:1. CA00402468 (2014-154)During an interview on 7/10/14 at approximately 9:00 AM, the hospital's Privacy Analyst (PA 1) reported that Patient xxxxxxx was seen in the Head and Neck Surgery and Oncology Clinic on 6/10/14 and a consultation letter from this visit was faxed to the wrong referring physician.Record review indicated the mis-faxed report contained Patient xxxxxxx name, medical record number, date of visit, date of birth, clinical history, surgical history, social history, current medications, allergies, physical examination, laboratory results, test results, assessment, and plan.PA 1 stated the hospital was notified of this error on 6/11/14. PA 1 stated a letter was sent to Patient xxxxxxx informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 6/17/14 notifying CDPH of the breach, and a copy of the letter sent to Patient xxxxxxx dated 6/16/14. 2. CA00402788 (2014-156)During an interview on 7/10/14 at approximately 9:15 AM, the hospital's Privacy Analyst (PA 1) reported that Patient xxxxxxx was seen in the Dermatology Clinic on 6/6/14 and an After Visit Summary was handed to the wrong patient.Record review indicated the mishandled report contained Patient xxxxxxx name, medical record number, date of visit, date of birth, clinical information, current medications laboratory specimens collected, future laboratory tests, and follow up appointment.PA 1 stated the hospital was notified of this error on 6/16/14. PA 1 stated a letter was sent to Patient xxxxxxx parent or guardian informing them of the breach of xxxxxxx medical information.Record review indicated a faxed report to CDPH dated 6/20/14 notifying CDPH of the breach, and a copy of the letter sent to Patient dated 6/20/14.3. CA00403097 (2014-157)During an interview on 7/10/14 at approximately 9:30 AM, the hospital's Privacy Analyst (PA 2) reported that Patient xxxxxxx was seen in the Anal Dysplasia Department on 6/10/14 and a consultation letter from this visit was faxed to the wrong physician.Record review indicated the mis-faxed report contained Patient xxxxxxx name, medical record number, date of visit, date of birth, clinical history, physical examination, test results, and plan.PA 2 stated the hospital was notified of this error on 6/18/14. PA 2 stated a letter was sent to Patient xxxxxxx informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 6/24/14 notifying CDPH of the breach, and a copy of the letter sent to Patient xxxxxxx dated 6/24/14. 4. CA00403515 (2014-159)During an interview on 7/10/14 at approximately 9:45 AM, the hospital's Privacy Analyst (PA 2) reported that Patient xxxxxxx was seen in the Ophthalmology Department on 6/19/14 and a consultation letter from this visit was faxed to the wrong physician.Record review indicated the mis-faxed report contained Patient xxxxxxx name, medical record number, date of visit, date of birth, clinical history, physical examination, test results,assessment, and plan.PA 2 stated the hospital was notified of this error on 6/20/14. PA 2 stated a letter was sent to Patient xxxxxxx parent or guardian informing them of the breach of xxxxxxx medical information.Record review indicated a faxed report to CDPH dated 6/26/14 notifying CDPH of the breach, and a copy of the letter sent to xxxxxxx parent or guardian dated 6/26/14. 5. CA00403565 (2014-160)During an interview on 7/10/14 at approximately 10:00 AM, the hospital's Privacy Analyst (PA 2) reported that Patient xxxxxxx was seen by the Neurosurgery Department on 6/17/14 - 6/18/14 and a Discharge Summary from this hospital stay was faxed to the wrong physician.Record review indicated the mis-faxed report contained Patient xxxxxxx name, medical record number, date of visit, date of birth, age, sex,clinical history, active problem list, physical examination, test results, discharge medications, and discharge instructions.PA 2 stated the hospital was notified of this error on 6/20/14. PA 2 stated a letter was sent informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 6/26/14 notifying CDPH of the breach, and a copy of the letter sent to xxxxxxx dated 6/26/14. 6. CA00403686 (2014-162)During an interview on 7/10/14 at approximately 10:15 AM, the hospital's Privacy Analyst (PA 3) reported that Patient xxxxxxx was scheduled to be seen for a Radiation Oncology Treatment. Patient xxxxxxx was supposed to bring a Surgical Pathology Report with her to the treatment but the report was emailed to the wrong patient. Record review indicated the mis-directed report contained Patient xxxxxxx name, surgical pathology number, date of birth, age, sex, and histopathological diagnosis.PA 3 stated the hospital was notified of this error on 6/23/14. PA 3 stated a letter was sent informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 6/27/14 notifying CDPH of the breach, and a copy of the letter sent to xxxxxxx dated 6/27/14.7. CA00403827 (2014-161)During an interview on 7/10/14 at approximately 10:30 AM, the hospital's Privacy Analyst (PA 3) reported that Patient xxxxxxx was seen in the Gastroenterology/Liver Clinic on 6/16/14 and a consultation letter from this visit was faxed to the wrong referring physician.Record review indicated the mis-faxed report contained Patient xxxxxxx name, medical record number, date of visit, date of birth, clinical history, surgical history, social history, current medications, allergies, physical examination, laboratory results, test results, impression, and plan.PA 3 stated the hospital was notified of this error on 6/23/14. PA 3 stated a letter was sent to Patient xxxxxxx informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 6/27/14 notifying CDPH of the breach, and a copy of the letter sent to Patient xxxxxxx dated 6/26/14.8. CA00404076 (2014-163) During an interview on 7/10/14 at approximately 10:45 AM, the hospital's Privacy Analyst (PA 3) reported that a letter for Patient xxxxxxx notifying her that she had tested positive for a germ called MRSA (Methcillin Resistant Staphylococcus Aureus) was mailed to the wrong patient.Record review indicated the mis-directed letter contained Patient xxxxxxx name, address, and infection status.PA 3 stated the hospital was notified of this error on 6/26/14. PA 3 stated a letter was sent to Patient xxxxxxx informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 7/1/14 notifying CDPH of the breach, and a copy of the letter sent to Patient xxxxxxx dated 7/1/14.9. CA00404189 (2014-164)During an interview on 7/10/14 at approximately 11:00 AM, the hospital's Privacy Analyst (PA 1) reported that progress notes for Patient xxxxxxx attesting to her need for continuous oxygen therapy were faxed to a private residence rather than to the oxygen supply company.Record review indicated the mis-directed fax contained Patient xxxxxxx name, diagnosis,age, sex, vital signs, history, current medications, physical examination, test results, assessment, and plan.PA 1 stated the hospital was notified of this error on 6/26/14. PA 1 stated a letter was sent to Patient xxxxxxx informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 7/2/14 notifying CDPH of the breach, and a copy of the letter sent to Patient xxxxxxx dated 7/1/14.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights