Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER
Cited by the California Department of Public Health for violations of California’s Health and Safety Code relating to medical privacy during an inspection that began on June 23, 2014. Also cited in 108 other reports.
Report ID: J2QP11.02, California Department of Public Health
Reported Entity: UCSF MEDICAL CENTER
Issue:
Based on interview and record review, the hospital failed to report the breach of protected health information within five business days of discovery of the breach:Findings:CA00400275 (2014-144)During an interview on 6/23/14 at approximately 11:15 AM, the hospital's Privacy Analyst (PA 2) reported that Clinical Services had a test fax number set up in an Information Technology (IT) system. The test number was designed to start with 9 so that no results would actually be sent outside the hospital. PA 2 stated that when a real fax number started with a 9 in the area code, the test number misread it and added another 9. If the resulting number was an actual fax number, real test results were sent.PA 2 stated that a recipient of one of these mis-directed faxes contacted the hospital on 5/12/14 and Clinical Services began an investigation to determine if other patients were also affected. PA 2 stated that four Patients, (I, J, K, and L) had protected health information (PHI) faxed to incorrect and unauthorized recipients.PA 2 stated the hospital was notified of this error on 5/12/14 by one of the four recipients.. PA 2 stated CDPH was not notified until all of the patients affected could be verified.Record review indicated a faxed report to CDPH dated 5/29/14 notifying CDPH of the breach, and a copy of the letters sent to Patients I and J dated 5/27/14 and a copy of the letters sent to Patients K and L dated 5/29/14.The hospital was ten days late in notifying CDPH of the breach of protected health information.
Outcome:
Deficiency cited by the California Department of Public Health: Health & Safety Code 1280