Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on August 21, 2014. Also cited in 108 other reports.
Report ID: Z34H11.01, California Department of Public Health
Reported Entity: UCSF MEDICAL CENTER
Issue:
Based on interview and record review, the hospital failed to maintain the confidentiality of patients' protected health information (PHI) when:1. Patient PR's After Visit Summary was handed to the wrong patient;2. Patient MD's insurance authorization form was faxed to an incorrect insurance company;3. Patient PS's Radiology requisition was handed to another patient; and4. Patient JM's consultation letter was faxed to the wrong provider.These errors had the potential for embarrassment to the patients whose personal information was breached, and for the potential of identity theft in the future.Findings:1. CA00406762 (2014-177)During an interview on 8/21/14 at approximately 9:45 AM, the hospital's Privacy Analyst (PA 1) stated Patient PR was seen in the Orthopedic Institute on 7/17/14 and at the end of this visit, two copies of Patient PR's After Visit Summary were printed. One of these copies was handed to another clinic patient by mistake. PA 1 said the other patient recognized the mistake and notified the clinic on 7/17/14.Record review indicated a copy of Patient PR's After Visit Summary, dated 7/17/14, which contained the following protected health information: name, sex, date of birth, date of service, medical record number, diagnoses, current medications, discharge instructions, and goals of treatment.Record review indicated a faxed letter dated 7/23/14, notifying the California Department of Public Health of this medical information breach.Record review indicated a copy of the letter, dated 7/23/14, sent to Patient PR notifying him/her of this breach of his/her medical information.2. CA00407019 (2014-178)During an interview on 8/21/14 at approximately 10:00 AM, PA 1 stated a clerk in the Positive Care Center had faxed Patient MD's insurance authorization request to the wrong insurance company. PA 1 said the hospital was notified of this error on 7/18/14. Record review indicated a copy of Patient MD's Prior Authorization Request Form, dated 7/17/14, which contained the following protected health information: name, sex, date of birth, address, telephone number, consultation and test requested.Record review indicated a faxed letter dated 7/24/14, notifying the California Department of Public Health of this medical information breach.Record review indicated a copy of the letter, dated 7/24/14, sent to Patient MD notifying him/her of this breach of his/her medical information.3. CA00407182 (2014-180)During an interview on 8/21/14 at approximately 10:15 AM, the hospital's Privacy Analyst (PA 2) stated Patient PS was seen in the Comprehensive Cancer Center and at the end of this visit, Patient PS's was supposed to receive a requisition for a CT (computer assisted tomography) imaging scan of the abdomen. The clerk handed this requisition to another patient by mistake. The Center was notified of this mistake on 7/21/14. Record review indicated a copy of Patient PS's requisition for the CT scan of the abdomen which contained the following protected health information: name, sex, date of birth, medical record number, diagnoses, and reason for the imaging scan.Record review indicated a faxed letter dated 7/25/14, notifying the California Department of Public Health of this medical information breach.Record review indicated a copy of the letter, dated 7/24/14, sent to Patient PS notifying him/her of this breach of his/her medical information.4. CA00407304 (2014-181)During an interview on 8/21/14 at approximately 9:45 AM, PA 2 stated Patient JM was seen in the Balance and Falls Center on 7/16/14. A copy of the consultation letter from this visit was faxed to the incorrect physician provider. PA 2 said the Center was notified of this error on 7/22/14.Record review indicated a copy of Patient JM's consultation letter, dated 7/21/14, which contained the following protected health information: name, date of birth, date of service, medical record number, clinical history, audiologic evaluation, results, impression, and recommendations.Record review indicated a faxed letter dated 7/28/14, notifying the California Department of Public Health of this medical information breach.Record review indicated a copy of the letter, dated 7/25/14, sent to Patient JM notifying him/her of this breach of his/her medical information.
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights