UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: KE6D11.03, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the hospital failed to protect the confidentiality of patients health information when:1. Patient MM's consultation letter, containing PHI, was faxed to an incorrect provider;2. Patient LT's Pathology Report, containing PHI, was faxed to the wrong provider;3. Patient NH's Radiology Report, containing PHI, was faxed to the wrong provider;4. Patient PB's Radiology Report, containing PHI, was faxed to an incorrect provider;5. Patient HS's Radiology Report, containing PHI, was faxed to the wrong provider;6. Patient TPR's consultation letter, containing PHI, was faxed to an incorrect provider; 7. Patient KA's consultation letter, containing PHI, was faxed to the wrong provider; and,8. Patient DP's Radiology Report, containing PHI, was faxed to an incorrect provider.These mistakes had the potential for embarrassment to the individuals whose personal health information was released and the potential for future identity theft. Findings: 1. CA00410280 (2014-198)In a telephone interview on 9/17/14 at 11:30 AM, the hospital's Risk Manager (RM) stated Patient MM was seen tin the Transplant Clinic and a consultation letter detailing this examination was faxed to the wrong provider.RM stated discovery of this error was on 8/19/14 and CDPH was notified by fax on 8/20/14. RM said Patient MM was notified of this breach by letter dated 8/20/14.In an interview on 10/7/14 at approximately 12:45 PM, the hospital's Privacy Analyst (PA 2) stated that the examining physician in the Liver Transplant Clinic, faxed his consultation note to the wrong provider.Record review indicated the consultation letter contained the following protected health information: Patient MM's name, medical record number, date of birth, sex, date of service, clinical history, systems review, current medications, allergies, family and social history, physical examination, laboratory and radiology results, assessment and plan. Record review indicated a fax, dated 8/20/14, notifying the California Department of Public Health (CDPH) of this breach. Record review indicated a copy of a letter, dated 8/20/14, sent to Patient MM notifying him/her of this breach of his/her medical information.2. CA00410833 (2014-200)During an interview on 10/7/14 at approximately 1:00 PM, PA 1 stated Patient LT's Pathology Report was mailed to the wrong provider who had the same last name but a different specialty. PA 1 said the hospital was notified of this mistake on 8/20/14Record review indicated the Pathology Report contained the following protected health information: Patient LT's name, medical record number, date of birth, sex, date of service, social security number, gross description of specimen, clinical history, and final Pathologic diagnosis.Record review indicated a fax, dated 8/25/14, notifying the California Department of Public Health (CDPH) of this breach. Record review indicated a copy of a letter, dated 8/25/14, sent to Patient LT notifying him/her of this breach of his/her medical information.3. CA00410958 (2014-201)During an interview on 10/7/14 at approximately 1:15 PM, PA 2 stated Patient NH's Radiology Report was faxed by a clerk, to an incorrect provider. PA 2 said the hospital was notified of this error by the recipient on 8/20/14.Record review indicated the Radiology Report contained the following protected health information: Patient NH's name, medical record number, date of birth, sex, date of service, social security number, X-Ray performed, clinical history, and radiologist's impression of findings.Record review indicated a fax, dated 8/26/14, notifying the California Department of Public Health (CDPH) of this breach. Record review indicated a copy of a letter, dated 8/26/14, sent to Patient NH notifying him/her of this breach of his/her medical information.4. CA00411421 (2014-204)During an interview on 10/7/14 at approximately 1:30 PM, PA 2 stated Patient PB's Radiology Report was faxed, by a clerk, to an incorrect provider. PA 2 said the hospital was notified of this error by the recipient on 8/25/14.Record review indicated the Radiology Report contained the following protected health information: Patient PB's name, medical record number, date of birth, sex, date of service, social security number, X-Ray performed, clinical history, and radiologist's impression of findings.Record review indicated a fax, dated 8/29/14, notifying the California Department of Public Health (CDPH) of this breach. Record review indicated a copy of a letter, dated 8/29/14, sent to Patient PB notifying him/her of this breach of his/her medical information.5. CA00411424 (2014-205) During an interview on 10/7/14 at approximately 1:45 PM, PA 2 stated Patient HS's Radiology Report was faxed, by a clerk, to an incorrect provider. PA 2 said the hospital was notified of this error by the recipient on 8/25/14.Record review indicated the Radiology Report contained the following protected health information: Patient HS's name, medical record number, date of birth, sex, date of service, social security number, X-Ray performed, clinical history, and radiologist's impression of findings.Record review indicated a fax, dated 8/29/14, notifying the California Department of Public Health (CDPH) of this breach. Record review indicated a copy of a letter, dated 8/29/14, sent to Patient HS notifying him/her of this breach of his/her medical information.6. CA00412711 (2014-209) In an interview on 10/7/14 at approximately 2:00 PM, the PA 2 stated that a clerk in the Pediatric Congenital Heart Clinic, faxed a consultation note to the wrong provider with a similar last name but a different specialty. Pa 2 said the hospital was notified of this error on 9/3/14.Record review indicated the consultation letter contained the following protected health information: Patient TPR's name, medical record number, date of birth, sex, date of service, clinical history, systems review, current medications, family and social history, physical examination, laboratory and radiology results, assessment and plan. Record review indicated a fax, dated 9/10/14, notifying the California Department of Public Health (CDPH) of this breach. Record review indicated a copy of a letter, dated 9/10/14, sent to Patient TPR's parent or guardian notifying him/her of this breach of their child's medical information.7. CA00413516 (2014-215)In an interview on 10/7/14 at approximately 2:45 PM, the PA 1 stated that a clerk in the Pediatric Congenital Heart Clinic, faxed a consultation note for Patient KA, to the wrong provider with a similar last name but a different specialty. PA 1 stated the hospital was notified of this mistake on 9/10/14.Record review indicated the consultation letter contained the following protected health information: Patient KA's name, medical record number, date of birth, sex, date of service, clinical history, systems review, current medications, family and social history, physical examination, prior study results, impression and recommendations. Record review indicated a fax, dated 9/16/14, notifying the California Department of Public Health (CDPH) of this breach. Record review indicated a copy of a letter, dated 9/16/14, sent to Patient KA's parent or guardian notifying him/her of this breach of their child's medical information.8. CA00413544 (2014-217)During an interview on 10/7/14 at approximately 1:15 PM, PA 2 stated Patient DP's Radiology Report was faxed by a clerk, to an incorrect provider. PA 2 said the hospital was notified of this error by the recipient on 9/11/14.Record review indicated the Radiology Report contained the following protected health information: Patient DP's name, medical record number, date of birth, sex, date of service, imaging test performed, clinical history, and radiologist's impression of findings.Record review indicated a fax, dated 9/17/14, notifying the California Department of Public Health (CDPH) of this breach. Record review indicated a copy of a letter, dated 9/16/14, sent to Patient DP notifying him/her of this breach of his/her medical information.

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights

Related Reports:

The report containing this deficiency also includes information about 2 other violations. Note that these may be related to the same event: KE6D11.01, KE6D11.02