UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: 5XUU11.02, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the hospital failed to maintain the confidentiality of protected health information when such information for eight patients was faxed to incorrect recipients. This had the potential for misuse of each patients confidential information.Findings:1. CA00392702 (2014-84)During an interview on 4/25/14 at approximately 9:00 AM, the hospital's Privacy Analyst (PA 1) reported that Patient A was seen in the Urologic Oncology Clinic on 3/18/14 and a post-operative procedure report was faxed to the wrong Primary Care Provider (PCP).Record review indicated the mis-faxed report contained Patient A's name, medical record number, date of visit, date of birth, clinical history, health information, a description of the procedures performed, and the consultant physician's findings.PA 1 stated the hospital was notified of this error on 3/21/14. PA 1 stated the consult letter was then sent to the correct PCP and a letter was sent to Patient A informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 3/26/14 at 2:31 PM notifying CDPH of the breach, and a copy of the letter sent to Patient A dated 3/25/14.2. CA00392828 (2014-85)During an interview on 4/25/14 at approximately 9:15 AM, PA 1 reported that Patient B was seen in Gastroenterology and Liver Clinic on 3/18/14 and a consultation letter about this visit was faxed to the wrong Primary Care Provider (PCP).Record review indicated the mis-faxed consult letter contained Patient B's name, medical record number, date of visit, date of birth, clinical history, assessment and the consultant's plan of care.PA 1 stated the hospital was notified of this error on 3/24/14. PA 1 stated the consult letter was then sent to the correct PCP and a letter was sent to Patient B informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 3/27/14 at 10:17 AM notifying CDPH of the breach, and a copy of the letter sent to Patient B dated 3/26/14. 3. CA00393588 (2014-90)During an interview on 4/25/14 at approximately 9:30 AM, PA 1 reported that Patient C was seen in Pediatric Otolaryngology Clinic on 3/20/14 and a consultation letter about this visit was faxed to the wrong Primary Care Provider (PCP).Record review indicated the mis-faxed consult letter contained Patient C's name, medical record number, date of visit, date of birth, clinical history, physical examination, procedure details, assessment and the consultant's plan of care.PA 1 stated the hospital was notified of this error on 3/28/14. PA 1 stated the consult letter was then sent to the correct PCP and a letter was sent to Patient C's Parent or Guardian informing them of the breach of Patient C's medical information.Record review indicated a faxed report to CDPH dated 4/3/14 at 2:12 PM notifying CDPH of the breach, and a copy of the letter sent to Patient C's Parent of Guardian dated 4/1/14. 4. CA00391564 (2014-76)During an interview on 4/25/14 at approximately 9:45 AM, the hospital's Privacy Analyst (PA 2) reported that Patient D was seen in the Neurosurgery Clinic on 3/10/14 and a consultation letter about this visit was faxed to the wrong Primary Care Provider (PCP).Record review indicated the mis-faxed consult letter contained Patient D's name, medical record number, date of visit, date of birth, and the consultant physician's plan of treatment.PA 2 stated the hospital was notified of this error on 3/12/14. PA 2 stated the consult letter was then sent to the correct PCP and a letter was sent to Patient D informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 3/17/14 at 3:11 PM notifying CDPH of the breach, and a copy of the letter sent to Patient D dated 3/13/14.5. CA00393807 (2014-93)During an interview on 4/25/14 at approximately 10:00 AM, the hospital's Privacy Analyst (PA 2) reported that Patient E and Patient F were seen in the Family Health Clinic and a staff person faxed Patient E's medical marijuana prescription and Patient F's Certificate of Medical Necessity for Diabetic Testing Supplies to an incorrect recipient.The original copies of the mis-faxed items were subsequently shredded but PA 2 confirmed that each contained protected health information. PA 2 stated the hospital was notified of this error on 3/26/14. PA 2 stated the hospital had difficulty verifying the breach so Patients E and F's did not receive notification letters until 4/4/14. Record review indicated a faxed report to CDPH dated 4/4/14 at 3:12 PM notifying CDPH of the breach. Record review indicated a notification letter to Patient E dated 4/4/14 which stated that the mis-faxed prescription contained Patient E's name, address, phone number, and some health information.Record review indicated a notification letter to Patient F dated 4/4/14 which stated that the mis-faxed prescription contained Patient F's name, date of birth, social security number, address, phone number, and some health information.6. CA00394165 (2014-94)During an interview on 4/25/14 at approximately 10:15 AM, the hospital's Privacy Analyst (PA 2) reported that Patient G was seen in the Epilepsy Clinic on 3/25/14 and a consultation letter about this visit was faxed to the wrong Primary Care Provider (PCP).Record review indicated the mis-faxed consult letter contained Patient G's name, medical record number, date of visit, date of birth, diagnoses, history and physical, and the consultant physician's recommendations.PA 2 stated the hospital was notified of this error on 4/2/14. PA 2 stated the consult letter was then sent to the correct PCP and a letter was sent to Patient G's Parent or Guardian informing them of the breach of Patient G's medical information.Record review indicated a faxed report to CDPH dated 4/8/14 at 8:51 AM notifying CDPH of the breach, and a copy of the letter sent to Patient G's Parent or Guardian dated 4/7/14.7. CA00394190 (2014-95)During an interview on 4/25/14 at approximately 9:45 AM, the hospital's Privacy Analyst (PA 2) reported that Patient H was seen in the Gastrointestinal Medical Oncology Clinic on 3/26/14 and a consultation letter about this visit was faxed to the wrong Primary Care Provider (PCP).Record review indicated the mis-faxed consult letter contained Patient H's name, medical record number, date of visit, date of birth, history, physical examination, assessment, and the consultant physician's plan.PA 2 stated the hospital was notified of this error on 4/3/14. PA 2 stated the consult letter was then sent to the correct PCP and a letter was sent to Patient H informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 4/8/14 at 3:10 PM notifying CDPH of the breach, and a copy of the letter sent to Patient H dated 4/8/14.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

The report containing this deficiency also includes information about 1 other violation. Note that these may be related to the same event: 5XUU11.01