UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: J2QP11.03, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the hospital failed to maintain the confidentiality of protected health information when such information for sixteen patients was faxed to incorrect and unauthorized recipients. This had the potential for misuse of each patients confidential information.Findings:1. CA00398035 (2014-121)During an interview on 6/23/14 at approximately 9:00 AM, the hospital's Privacy Analyst (PA 1) reported that Patient A was seen in the Liver Transplant Clinic on 5/6/14 and a consultation letter was faxed to the wrong referring physician.Record review indicated the mis-faxed report contained Patient A's name, medical record number, date of visit, date of birth, clinical history, surgical history, social history, current medications, allergies, physical examination, laboratory results, test results, assessment and plan of care.PA 1 stated the hospital was notified of this error on 5/7/14. PA 1 stated the consult letter was sent to the correct PCP and a letter was sent to Patient A informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 5/9/14 notifying CDPH of the breach, and a copy of the letter sent to Patient A dated 5/9/14.2. CA00398252 (2014-124)During an interview on 6/23/14 at approximately 9:15 AM, the hospital's Privacy Analyst (PA 2) reported that Patient B was seen in the Emergency Department on 5/6/14 and a consultation letter was faxed to the wrong Primary Care Physician (PCP).Record review indicated the mis-faxed report contained Patient B's name, medical record number, date of visit, chief complaint, diagnosis and follow up instructions.PA 2 stated the hospital was notified of this error on 5/6/14. PA 2 stated the consult letter was sent to the correct PCP and a letter was sent to Patient B informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 5/12/14 notifying CDPH of the breach, and a copy of the letter sent to Patient B dated 5/12/14.3. CA00398261 (2014-125)During an interview on 6/23/14 at approximately 9:30 AM, the hospital's Privacy Analyst (PA 1) reported that Patient C was seen in the Pediatric Heart Center on 4/4/14 and a consultation letter was faxed to the wrong referring physician.Record review indicated the mis-faxed report contained Patient C's name, medical record number, date of visit, date of birth, clinical history, social history, current medications, allergies, physical examination, test results, assessment and recommendations.PA 1 stated the hospital was notified of this error on 5/7/14. PA 1 stated the consult letter was sent to the correct PCP and a letter was sent to Patient C's guardian informing him/her of the breach of Patient C's medical information.Record review indicated a faxed report to CDPH dated 5/13/14 notifying CDPH of the breach, and a copy of the letter sent to Patient C's guardian dated 5/12/14.4. CA00398435 (2014-129)During an interview on 6/23/14 at approximately 9:45 AM, the hospital's Privacy Analyst (PA 2) reported that Patient D was seen in the Neurology Clinic on 4/17/14 and a consultation letter was faxed to an outdated fax number and was received by an unauthorized recipient.Record review indicated the mis-faxed report contained Patient D's name, medical record number, date of visit, date of birth, clinical history, current medications, allergies, physical examination, assessment and plan of carePA 2 stated the hospital was notified of this error on 5/8/14. PA 2 stated the consult letter was sent to the correct PCP and a letter was sent to Patient D informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 5/14/14 notifying CDPH of the breach, and a copy of the letter sent to Patient D dated 5/13/14.5. CA00398748 (2014-130)During an interview on 6/23/14 at approximately 10:00 AM, the hospital's Privacy Analyst (PA 2) reported that Patient E was seen in the Emergency Department on 5/11/14 and an Application for a 72 Hour Detention was faxed to an incorrect and unauthorized recipient.Record review indicated the mis-faxed request contained Patient E's name, medical record number, date of visit, history, and psychiatric assessment.PA 2 stated the hospital was notified of this error on 5/12/14. PA 2 stated Patient E's mother was notified of the error by telephone on 5/16/14.Record review indicated a faxed report to CDPH dated 5/16/14 notifying CDPH of the breach, and a copy of the letter sent to Patient E's guardian dated 5/21/14. The letter was delayed to to mental health considerations and the need to consult with the original medical team. 6. CA00398776 (2014-131)During an interview on 6/23/14 at approximately 10:15 AM, the hospital's Privacy Analyst (PA 1) reported that Patient F had slides of surgically removed tissues sent to the hospital on 5/5/14 for a second opinion and the Surgical Pathology Report was faxed to the wrong fax number for the referring pathologist.Record review indicated the mis-faxed report contained Patient F's name, social security number, medical record number, date of service, date of birth, sex, final pathological diagnosis, and comments.PA 1 stated the hospital was notified of this error on 5/13/14. PA 1 stated the Surgical Pathology Report was then sent to the correct pathologist and a letter was sent to Patient F informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 5/16/14 notifying CDPH of the breach, and a copy of the letter sent to Patient F dated 5/16/14. 7. CA00399220 (2014-132)During an interview on 6/23/14 at approximately 10:30 AM, the hospital's Privacy Analyst (PA 2) reported that Patient G was seen in the Comprehensive Cancer Center on 5/12/14 and a consultation letter was faxed to the incorrect referring physician.Record review indicated the mis-faxed report contained Patient G's name, medical record number, date of visit, date of birth, sex, clinical history, current medications, allergies, social history, physical examination, laboratory results, test results, assessment and plan of carePA 2 stated the hospital was notified of this error on 5/14/14. PA 2 stated the consult letter was sent to the correct referring physician and a letter was sent to Patient G informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 5/20/14 notifying CDPH of the breach, and a copy of the letter sent to Patient G dated 5/19/14. 8. CA00400167 (2014-143)During an interview on 6/23/14 at approximately 11:00 AM, the hospital's Privacy Analyst (PA 1) reported that Patient H was seen in the Adult Epilepsy Clinic on 5/17/14 and a Discharge Summary was faxed to an outdated fax number and was received by the incorrect and unauthorized recipient.Record review indicated the mis-faxed report contained Patient H's name, medical record number, date of visit, date of birth, sex, clinical history, description of hospital course, current medications, allergies, physical examination at discharge, laboratory results, test results, and assessment at discharge.PA 1 stated the hospital was notified of this error on 5/22/14. PA 1 stated the consult letter was sent to the correct Primary Care Physician and a letter was sent to Patient H informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 5/29/14 notifying CDPH of the breach, and a copy of the letter sent to Patient H dated 5/29/14. 9. CA00400275 (2014-144)During an interview on 6/23/14 at approximately 11:15 AM, the hospital's Privacy Analyst (PA 2) reported that Clinical Services had a test fax number set up in an Information Technology (IT) system. The test number was designed to start with 9 so that no results would actually be sent outside the hospital. PA 2 stated that when a real fax number started with a 9 in the area code, the test number misread it and added another 9. If the resulting number was an actual fax number, real test results were sent.PA 2 stated that a recipient of one of these mis-directed faxes contacted the hospital on 5/12/14 and Clinical Services began an investigation to determine if other patients were also affected. PA 2 stated that four Patients, (I, J, K, and L) had protected health information (PHI) faxed to incorrect and unauthorized recipients.Record review indicated the Operative Report for Patient I was sent to an incorrect and unauthorized physician. This report contained Patient I's name, medical record number, age, sex, date of surgery, clinical indications, and type of surgery performed with procedure details.Record review indicated electrocardiogram results and computer assisted tomography of the abdomen and pelvis results for Patient J were sent to an incorrect and unauthorized physician. These reports contained Patient J's name, date of birth, sex, date of service, and clinical findings.Record review indicated the specimen collection requisitions for cultures of left hip fluid for Patient K were sent to an incorrect and unauthorized physician. These requisitions contained Patient K's name, date of birth, and medical record number as well as a description of the tests to be performed on the samples.Record review of the Neonatal Screening results for Patient L were sent to an incorrect and unauthorized physician. This report contained Patient L's name, date of birth, date of service medical record number , and the test results. PA 2 stated the hospital was notified of this error on 5/12/14 by one of the four recipients.. PA 2 stated CDPH was not notified until all of the patients affected could be verified.Record review indicated a faxed report to CDPH dated 5/29/14 notifying CDPH of the breach, and a copy of the letters sent to Patients I and J dated 5/27/14 and a copy of the letters sent to Patients K and L dated 5/29/14.The hospital was ten days late in notifying CDPH of the breach of protected health information.10. CA00400401 (2014-145) During an interview on 6/23/14 at approximately 11:30 AM, the hospital's Privacy Analyst (PA 3) reported that Patient M was seen in the Pediatric Pulmonary Hypertension Clinic on 5/20/14 and a consultation letter was faxed to the wrong Primary Care Physician.Record review indicated the mis-faxed report contained Patient M's name, medical record number, date of visit, date of birth, sex, chief complaint, clinical history, current medications, family and social history, physical examination, laboratory results, test results, assessment and recommendations.PA 3 stated the hospital was notified of this error on 5/23/14. PA 3 stated the consult letter was sent to the correct PCP and a letter was sent to Patient M's parents informing them of the breach of Patient M's medical information.Record review indicated a faxed report to CDPH dated 5/30/14 notifying CDPH of the breach, and a copy of the letter sent to Patient M's parents dated 5/29/14.11. CA00400442 (2014-146)During an interview on 6/23/14 at approximately 11:45 AM, the hospital's Privacy Analyst (PA 3) reported that Patient N was seen in the Hematology/Bone Marrow Transplant/ Transfusion Services on 5/2/14 and the progress notes of this visit were faxed to an incorrect and unauthorized recipient. Record review indicated the mis-faxed report contained Patient N's name, medical record number, date of visit, clinical history, current medications, physical examination, laboratory results, test results, assessment and plan.PA 3 stated the hospital was notified of this error on 5/23/14. PA 3 stated a letter was sent to Patient N informing her of the breach of her medical information.Record review indicated a faxed report to CDPH dated 5/30/14 notifying CDPH of the breach, and a copy of the letter sent to Patient N dated 5/29/14.12. CA00400566 (2014-149)During an interview on 6/23/14 at approximately 12:00 PM, the hospital's Privacy Analyst (PA 1) reported that Patient O had kidney biopsy tissues sent to the hospital on 5/16/14 for a examination and the Surgical Pathology Report was faxed to the wrong fax number and ,hence, an unauthorized and incorrect recipient.Record review indicated the mis-faxed report contained Patient O's name, social security number, medical record number, date of service, date of birth, sex, final pathological diagnosis, and comments.PA 1 stated the hospital was notified of this error on 5/27/14. PA 1 stated the Surgical Pathology Report was then sent to the correct pathologist and a letter was sent to Patient O informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 6/2/14 notifying CDPH of the breach, and a copy of the letter sent to Patient O dated 5/30/14. 13. CA00400569 (2014-150)During an interview on 6/23/14 at approximately 12:15 PM, the hospital's Privacy Analyst (PA 1) reported that Patient P was seen in the Liver Transplant Clinic on 5/27/14 and a consultation letter was faxed to the wrong referring physician.Record review indicated the mis-faxed report contained Patient P's name, medical record number, date of visit, date of birth, clinical history, surgical history, social history, current medications, allergies, physical examination, laboratory results, test results, and assessment.PA 1 stated the hospital was notified of this error on 5/28/14. PA 1 stated the consult letter was sent to the correct PCP and a letter was sent to Patient P informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 6/2/14 notifying CDPH of the breach, and a copy of the letter sent to Patient P dated 5/30/14.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

The report containing this deficiency also includes information about 2 other violations. Note that these may be related to the same event: J2QP11.01, J2QP11.02