UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: G4CR11, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review the hospital failed to maintain the confidentiality of individually identifiable medical information for four patients when clinical assistant staff gave the After Visit Summary and Outpatient Referral Forms reports to incorrect recipients. This had the potential for misuse of each patient's confidential medical information.Findings:1. CA 00397063During an interview on 6/11/14 at 10:53 AM, the hospital's Privacy Analyst (PA 1) reported that Patient A was seen in the Comprehensive Cancer Center Clinic on 4/3/14 and Patient A's After Visit Summary report was given by a clinical staff assistant to the wrong patient. The document was mailed back to the hospital on 4/25/14. PA-1 said that the After Visit Summary was printed twice on the same printer and that may be why the report was given to the wrong patient.Record review indicated, the After Visit Summary report contained Patient A's name, date of birth, medical record number, medication history, date of visit and computer activation code (ucsfymychart) to remotely view laboratory results.2. CA00397073During an interview on 6/11/14 at 10:30 AM, the hospital's Privacy Analyst (PA 1) reported that Patient B was seen in the Gastroenterology Practice Clinic on 4/28/14 and Patient B's After Visit Summary report was handed to another patient by the clinical assistant who was discharging the patient. The clinical assistant discovered the error and called the recipient of Patient B's After Visit Summary who destroyed the document. In the same interview PA 1 was asked when patients are discharged with the After Visit Summary, does the clinical assistant verify the patient's name, birthday or medical record number on the document with some kind of personal identification card of the patient? PA-1 said he did not know if that unit had a policy in effect like that, he would need to check.Record review indicated a After Visit Summary report contained Patient B's name, date of birth, diagnoses, medication history and laboratory requests.3. CA00397648During an interview on 6/20/14 at 10:30 AM, the hospital's Privacy Analyst (PA 2) reported that Patient C and Patient D's Outpatient Referral/Laboratory request was given to the wrong recipient during a Comprehensive Cancer Center Clinic visit on 4/30/14. PA-2 said," The Nurse Practioner who was discharging a different patient grabbed about 10 or twelve pages off the printer. These pages contained the Outpatient referral / Laboratory request for Patient C and D. We believe the Nurse Practioner failed to double check the names on the forms before giving them to the wrong recipient. Patient C's request form had her name, date of birth, a diagnosis of post-menopausal bleeding and a laboratory blood test order. Patient D's request form contained the name and medical record number of Patient D and a request for a laboratory blood test. The recipient of Patient C and D's request forms contacted us then destroyed them."Record review of a notification letter sent to Patient C, dated 5/7/14, indicated that the Outpatient referral / Laboratory request form contained Patient C's name, address, phone number, date of birth and medical record number and some health information.Record review of a notification letter sent to Patient D ,dated 5/7/14, indicated Outpatient referral / Laboratory request form contained Patient D's name, medical record number, and some health information.During a interview on 6/20/14 at 11 AM the hospital's Risk Manger was asked if there was a policy for personal discharging patients to use two patient identifiers to make sure the patient was getting the right document.The Risk Manger said there was no formal policy but that they were working on one.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights