UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: 0NUY11.01, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the hospital failed to protect personal health information when:1. Patient 1's imaging results were faxed to an incorrect healthcare provider;2. Patient 2's Discharge Summary was included in another patient's Discharge Summary and was given to the wrong patient;3. Patient 3's Summary of Care was faxed to the wrong provider;4. Patient 4's After Visit Summary was mailed to the wrong recipient;5. Patient 5's Operative Report was faxed to the wrong provider;6. Patient 6's Operative Report was faxed to a wrong number; and7. Patient 7's consultation letter was sent to the wrong provider.Findings:1. CA00422188 (2014-251)During an interview on 1/26/15 at approximately 2:00 PM, the hospital's Privacy Analyst (PA 1) stated that both the intended recipient and the actual recipient had similar names. The clerk who faxed the imaging results did not follow the hospital's procedure for identifying the correct recipient and he/she faxed the imaging results to the incorrect provider. PA 1 stated the recipient returned the misfaxed information on 11/24/14 and Patient 1 was notified by letter, dated 12/2/14, that his/her protected health information had been breached.Record review indicated Patient 1's imaging report contained the following protected health information: name, medical record number, date of birth, date of service, type of procedure, clinical history, procedure findings, impression, and recommendations.Record review indicated a telephoned report, dated 12/2/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 1's confidential information.Record review indicated a letter, dated 12/2/14, notifying Patient 1 of the breach of his/her confidential information. 2. CA00422193 (2014 - 250)During an interview on 1/26/15 at approximately 2:15 PM, the hospital's Privacy Analyst (PA 4) stated the nurse preparing Patient 2's Discharge Summary was also preparing another one for a different patient. The nurse put both summaries in one envelope and handed them to the transporter. PA 4 stated the hospital was notified of the error on 11/24/14 and Patient 2 was notified by letter, dated12/2/15, that his/her protected health information had been breached.Record review indicated Patient 2's Discharge Summary contained the following protected health information: name, medical record number, dates of service, current medications, physicians' names, address, phone number, and Discharge Instructions.Record review indicated a telephoned report, dated 12/2/14, notifying CDPH of the breach of Patient 2's confidential information.Record review indicated a letter, dated 12/2/14, notifying Patient 2 of the breach of his/her confidential information. 3. CA00422837 (2014-252) During an interview on 1/26/15 at approximately 2:30 PM, PA 4 stated Patient 3's Summary of Care was sent to the correct provider but at his/her wrong address. Persons at the old address returned the fax to the hospital on 12/1/14.PA 1, also present during this interview, stated that the provider's new address had been entered into the system but because of a technical error, the system selected the old address. PA 1 stated the Information Technology Department was working on this unique technical problem.Record review indicated Patient 3's Summary of Care contained the following protected health information: name, date of birth, current medications, procedure notes, vital signs, upcoming appointments, and discharge instructions.Record review indicated a faxed letter, dated 12/8/14, notifying CDPH of the breach of Patient 3's confidential information.Record review indicated a letter, dated 12/5/14, notifying Patient 3 of the breach of his/her confidential information.4. CA00424758 (2014-255)During an interview on 1/26/15 at approximately 3:15 PM, PA 1 stated that both the intended recipient and the actual recipient were seen in the clinic on the same day. The clerk mailed Patient 4's After Visit Summary to an incorrect recipient who notified the hospital of the error on 12/16/14. PA 1 stated Patient 4 was notified by letter dated 12/22/14 that his/her protected health information had been breached.Record review indicated Patient 4's After Visit Summary contained the following protected health information: name, medical record number, date of birth, date of service, diagnoses, vital signs, allergies, and current medications.Record review indicated a faxed letter, dated 12/23/14, notifying the CDPH of the breach of Patient 4's confidential information.Record review indicated a letter, dated 12/22/14, notifying Patient 4 of the breach of his/her confidential information. 5. CA00424779 (2014-256)During an interview on 1/26/15 at approximately 3:30 PM, PA 4 stated that Patient 5 was a self-referral (had no referring doctor) and the clerk entered this information incorrectly causing the operative report to be sent to Dr. Self. PA 4 stated the hospital was notified of the error on 12/17/14 and Patient 5 was notified by letter, dated 12/23/15, that his/her protected health information had been breached.PA 1, also present during this interview, stated the hospital's Information Technology Department was working on a solution to the recurring transmission problems between self-referrals and Dr. SelfRecord review indicated Patient 5's Operative Report contained the following protected health information: name, medical record number, dates of surgery, diagnoses, history, and procedure notes.Record review indicated a telephoned report, dated 12/24/14, notifying CDPH of the breach of Patient 5's confidential information.Record review indicated a letter, dated 12/23/14, notifying Patient 5 of the breach of his/her confidential information.6. CA00425926 (2015-001) During an interview on 1/26/15 at approximately 3:45 PM, PA 1 stated the Operative Report was sent to the correct physician but at the wrong fax number The physician had left his practice group and moved out of state and the hospital's system had not been updated to reflect this. A person at the old practice returned the fax to the hospital on 12/28/14. PA 1 stated Patient 6 was notified by letter, dated 1/2/15, that his/her protected health information had been breached.Record review indicated Patient 6's Operative Report contained the following protected health information: name, medical record number, dates of surgery, diagnoses, history, findings, and procedure notes. Record review indicated a faxed letter, dated 1/5/15, notifying CDPH of the breach of Patient 6's confidential information.Record review indicated a letter, dated 1/2/15, notifying Patient 6 of the breach of his/her confidential information.7. CA00426052 (2015- 002) During an interview on 1/26/15 at approximately 4:00 PM, PA 1 stated that both the intended recipient and the actual recipient had the same first and last names. The clerk did not verify the middle name and faxed the consultation letter to an incorrect recipient. PA 1 stated the hospital became aware of this error on 12/29/15 and Patient 7 was notified by letter, dated 1/6/15, that his/her protected health information had been breached.Record review indicated Patient 7's consultation letter contained the following protected health information: name, medical record number, date of birth, date of service, diagnoses, social history, family history, review of systems, physical examination, allergies, and assessment and plan.Record review indicated a faxed letter, dated 1/6/15, notifying CDPH of the breach of Patient 7's confidential information.Record review indicated a letter, dated 1/6/15, notifying Patient 7 of the breach of his/her confidential information.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

3 other violations reported on the same date. Note that other citations may be about the same event: D6DQ11.01, D6DQ11.02, D6DQ11.03