UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: THEB11.02, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to maintain the confidentiality of protected health information when such information was stolen out of a locked trunk of a Pediatric resident's vehicle. The bag contained face sheets and sign-outs (paper documents containing PHI (personal health information) for a total of 14 facility patients(patient 1, patient 2, patient 3, patient 4, patient 5, patient 6, patient 7, patient 8, patient 9, patient 10, patient 11, patient 12, patient 13, patient 14.)Findings for CA00398405:During an interview on 7/3/14 at 12:45 PM , Risk Manager stated, "We verified this incident on 4/30/14. We were notified of this incident on 4/25/14. Staff 1,who was responsible for the adverse event was re-educated."Record review indicated, "the information in the face sheets and PHI for 14 patients contained the patient's name with first initial, medical record number, and some health information. It did not contain the social security number or any other personal or financial information for this patient."During an interview on 7/3/14 at 1:15 PM, Risk Manager stated, "the facility was aware of the error on 4/25/14. The notification to the parents or guardians of the patients' whose health information was inadvertently disclosed were notified of the breach of his/her medical information was sent on 5/12/14 by letter from the manager of the department of Pediatrics. I am aware of the late reporting."Record review of the facility's Fax Transmittal Sheet, dated 5/13/14, indicated notification of the breach to CDPH. Attached copies of the letters sent to the patients' parents or guardians were dated 5/12/14. The facility was not in compliance within the timeframe of reporting. The facility was 11 days late in reporting to the Department the information breach within five business days after it was detected.Findings for CA00400173:Based on interview and record review, the facility failed to maintain the confidentiality of protected health information when a Patient's "Plan of Care letter" was inadvertently mailed to the incorrect healthcare provider by Staff #2.During an interview on 7/3/14 at 1:30 PM , Risk Manager stated, "We verified this incident on 5/27/14. We were notified of this incident on 5/19/14. Staff #2, who was responsible for this adverse event was re-educated on the procedure "Acknowledgement of Responsibility."Record review indicated, "the information in the Plan of Care letter contained your name , medical record number, address and some health information. It did not contain the social security number or any other personal or financial information."During an interview on 7/3/14 at 1:50 PM, Risk Manager stated, "the facility was aware of the error on 5/27/14. The notification to the patient whose health information was inadvertently disclosed were notified of the breach of his/her medical information was sent on 5/28/14 by letter from the manager of the department of Accreditation and Licensing. I am aware of the late reporting."Record review of the facility's Fax Transmittal Sheet, dated 5/29/14, indicated notification of the breach to CDPH. Attached copy of the letter sent to the patient were dated 5/28/14. The facility was not in compliance within the timeframe of reporting. The facility was 2 days late in reporting to the Department the information breach within five business days after it was detected.

Outcome:

Deficiency cited by the California Department of Public Health: HSC Section 1279

Related Reports:

The report containing this deficiency also includes information about 2 other violations. Note that these may be related to the same event: THEB11.01, THEB11.03

2 other violations reported on the same date. Note that other citations may be about the same event: YOC311.01, YOC311.02