SAN FRANCISCO GENERAL HOSPITAL

Report ID: JJKG11.02, California Department of Public Health

Reported Entity: SAN FRANCISCO GENERAL HOSPITAL

Issue:

Based on interview and record review, the facility failed to notify the California Department of Public Health of the likely breach of medical information within the five days specified in the regulation.Findings:During an interview on 1/17/13 at 4:15 PM, the facility's Privacy Officer (PO) related the details of her investigation. The PO stated she was initially alerted to the potential breach by the Risk Management Department on 11/5/12. The source of this information was a Nurse Midwife in the Obstetrics Clinic (Staff 1). The PO stated that on 11/6/12 she interviewed Staff 1 who related that a patient in the clinic, Patient 1, believed that an employee (Staff 1) in another department had accessed her medical information and had passed this on the Patient 1's ex-boyfriend. The PO stated that on 11/6/12, she had an audit run of the computer access into Patient 1's Lifetime Care Record (LCR) which indicated unauthorized access by Staff 1 on 5/16/12 and 9/5/12. The PO continued her investigation but the subsequent interviews with Staff 1 required Union representation and the interviews with Patient 1 required translator services. These interviews could not completed until 11/14/12.Risk Management and the Privacy Officer became aware of the potential breach on 11/5/12 but did not report it to CDPH until 11/16/12.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

The report containing this deficiency also includes information about 2 other violations. Note that these may be related to the same event: JJKG11.01, JJKG11.03