UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: PYXY11.01, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the facility failed to notify the California Department of Public Health (CDPH) of the breach of personal patient health information within the required five business days after the breach was detected. Findings:Patient A was seen at the Gastroenterology and Liver Faculty Practice on 4/16/12 and a copy of the progress notes of the clinic visit was supposed to be send to his primary provider. The progress notes included his name, date of birth, medical record number, medical history, laboratory results, medical assessment and plan of care.In an interview on 6/22/12 at 1:55 p.m., the Manager of Accreditation, Licensure and Certification (Staff A) stated the information breach happened on 4/19/12 when the summary of Patient A's visit was sent to the wrong provider. She stated Patient A's provider no longer practices at the address the progress notes were sent to. Staff A said the breach was reported by fax to the Department on 4/27/12. She stated she sent a hard copy of the breach notification to CDPH by mail and was informed by the Department that notification of the breach was received on 6/8/12. Staff A said CDPH staff told her that a fax notification of the breach was never received. She stated she then realized that on 4/27/12, she inadvertently faxed the notification of the breach to another fax number (her office in another campus) and not to the fax number of the Department. The facility was 43 days late in reporting the information breach within five business days after it was detected.

Outcome:

Deficiency cited by the California Department of Public Health: Health & Safety Code 1280

Related Reports:

2 other violations reported on the same date. Note that other citations may be about the same event: Q23911.01, Q23911.02