UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: JFW811, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the hospital failed to maintain the confidentiality of protected health information when:1. Patient 1's consultation letter was faxed to the wrong healthcare provider;2. Patient 2's Disability Insurance application was mailed to an incorrect recipient;3. Patient 3's discharge notice was faxed to the wrong provider;4. Patient 4's discharge notice and progress notes were sent to the wrong provider;5. Patient 5's procedure fee was emailed to an incorrect recipient;6. Patient 6's After Visit Summary was handed to the wrong patient;7. Patient 7's Discharge Summary was faxed to the wrong provider; and,8. Patient 8's After Visit Summary, Laboratory Requisition, and Radiology Order were handed to the wrong patient.These lapses in maintaining the confidentiality of patients' protected health information had the potential for embarrassment to the patient if sensitive information was released, and the potential for future identity theft using the misdirected information.Findings:1. CA00417690 (2014-235)During an interview on 11/26/14 at 10:15 AM, the hospital's Privacy Analyst (PA 2) stated that during the registration process added an extra provider to the care team. This provider was not a part of the care team, and received Patient 1's Consultation letter in error.PA 2 stated the hospital was notified of this error on 10/14/14 and a letter was sent to Patient 1 on 10/20/14 notifying him/her of the breach of his/her protected health information.Record review indicated the Consultation letter contained Patient 1's name, sex, date of birth, date of service, medical record number, diagnosis, history and physical, current medications, and assessment.Record review also indicated a faxed notice of the medical information breach sent to the California Department of Public Health (CDPH) on 10/20/14, and a copy of the letter sent to Patient 1 dated 10/20/14.2. CA00419397 (2014-242)During an interview on 11/26/14 at 10:30 AM, the hospital's Privacy Analyst (PA 3) stated that an administrative clerk put the wrong mailing label on Patient 2's Disability application forms.PA 3 stated the hospital was notified of this error on 10/30/14 when the recipient returned the mis-mailed information to the hospital. PA 3 said a letter was sent to Patient 2 on 11/5/14 notifying him/her of the breach of his/her protected health information.Record review indicated the Disability application form contained Patient 2's name, address, date of service, claim number, diagnosis, and estimated date of return to work.Record review also indicated a faxed notice of the medical information breach sent to the California Department of Public Health (CDPH) on 11/5/14, and a copy of the letter sent to Patient 2 dated 11/5/14.3. CA00419545 (2014-243)During an interview on 11/26/14 at 10:45 AM, the hospital's Privacy Analyst (PA 3) stated that Patient 3 was a self-referral to a hospital clinic. Rather than enter self-referral, the registration clerk selected an incorrect provider and Patient 3's Discharge Summary and Instructions were faxed to the wrong provider.PA 3 stated the hospital was notified of this error on 10/31/14 and a letter was sent to Patient 3's parent or guardian on 11/6/14 notifying him/her of the breach of Patient 3's protected health information.Record review indicated the Discharge Summary contained Patient 3's name, sex, date of birth, dates of service, medical record number, diagnosis, history and physical, hospital course, discharge medications, and home treatment care plan.Record review also indicated a faxed notice of the medical information breach sent to the California Department of Public Health (CDPH) on 11/6/14, and a copy of the letter sent to Patient 3's parent or guardian dated 11/6/14.4. CA00419548 (2014-244) During an interview on 11/26/14 at 11:00 AM, the hospital's Privacy Analyst (PA 3) stated that Patient 4's Discharge Summary and a copy of the inpatient hospital stay were faxed to the wrong provider who had a similar name. A hospital reviewer noticed the error and contacted the receiving hospital which located the mis-faxed documents and destroyed them.PA 3 stated the hospital became aware of this error on 10/31/14 and a letter was sent to Patient 4's mother on 11/6/14 notifying her of the breach of Patient 4's protected health information.Record review indicated the Discharge Summary contained Patient 4's name, sex, date of birth, dates of service, medical record number, diagnosis, history and physical, prenatal and birth history, surgical procedures, hospital course, immunizations, and follow up appointments.Record review also indicated a faxed notice of the medical information breach sent to the California Department of Public Health (CDPH) on 11/6/14, and a copy of the letter sent to Patient 4's mother dated 11/6/14.5. CA00420039 (2014-246)During an interview on 11/26/14 at 11:15 AM, the hospital's Privacy Analyst (PA 2) stated that Patient 5's procedural fee request letter was emailed to an incorrect recipient PA 2 said the recipient notified the hospital of the error on 11/5/14 and shredded the document.PA 2 stated a letter was sent to Patient 5 on 11/10/14 notifying him/her of the breach of his/her protected health information.Record review indicated the letter contained Patient 5's name, the procedures performed with fees requested, and a list of potential future procedures and costs.Record review also indicated a faxed notice of the medical information breach sent to the California Department of Public Health (CDPH) on 11/12/14, and a copy of the letter sent to Patient 5 dated 11/10/14. 6. CA00420228 (2014-247)During an interview on 11/26/14 at 11:30 AM, the hospital's Privacy Analyst (PA 2) stated that during the discharge process a clerk printed multiple copies of Patient 6's After Visit Summary. One of these copies was handed to the wrong patient by mistake.PA 2 stated the hospital was notified of this error on 11/7/14 when the recipient returned the document to the hospital. PA 2 said a letter was sent to Patient 6 on 11/13/14/14 notifying him/her of the breach of his/her protected health information.Record review indicated the After Visit Summary contained Patient 6's name, sex, date of birth, date of service, medical record number, diagnoses, current medications,immunizations, pre-surgical instructions, and future appointments. Record review also indicated a faxed notice of the medical information breach sent to the California Department of Public Health (CDPH) on 11/13/14, and a copy of the letter sent to Patient 6 dated 11/13/14. 7. CA00420701 (2014-248)During an interview on 11/26/14 at 11:00 AM, the hospital's Privacy Analyst (PA 3) stated that Patient 7's Discharge Summary and discharge instructions were faxed to the wrong provider who notified the hospital of the mistake and shredded the original fax.PA 3 stated the hospital became aware of this error on 11/7/14 and a letter was sent to Patient 7 on 11/17/14 notifying him/her of the breach of his/her protected health information.Record review indicated the Discharge Summary contained Patient 7's name, sex, date of birth, dates of service, medical record number, diagnoses, history and physical, laboratory test results, hospital course, current medications, immunizations, discharge assessment, and follow up appointments.Record review also indicated a faxed notice of the medical information breach sent to the California Department of Public Health (CDPH) on 11/10/14, and a copy of the letter sent to Patient 7 dated 11/17/14. 8. CA00421147 (2014-249)During an interview on 11/26/14 at 11:30 AM, the hospital's Privacy Analyst (PA 2) stated that during the discharge process a clerk printed two copies of Patient 8's After Visit Summary and did not follow the hospital procedure for checking the document before giving it to the patient. The clerk gave Patient 8's After Visit Summary to a different patient. PA 2 stated the hospital was notified of this error on 11/14/14 when the recipient returned the document to the hospital. PA 2 said a letter was sent to Patient 8 on 11/20/14/14 notifying him/her of the breach of his/her protected health information.Record review indicated the After Visit Summary contained Patient 8's name, sex, date of birth, date of service, medical record number, diagnoses, current medications, laboratory requisition, and radiology order.Record review also indicated a faxed notice of the medical information breach sent to the California Department of Public Health (CDPH) on 11/20/14, and a copy of the letter sent to Patient 6 dated 11/20/14.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights