Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER
Cited by the California Department of Public Health for a violation of California’s Health and Safety Code relating to medical privacy during an inspection that began on July 21, 2014. Also cited in 108 other reports.
Report ID: LX8Q11, California Department of Public Health
Reported Entity: UCSF MEDICAL CENTER
Issue:
Based on interview and record review, the hospital failed to maintain the confidentiality of protected health information when such information for eight patients was faxed to incorrect recipients. This had the potential for misuse of each patients confidential information.Findings:1. CA00406050 (2014-174)During an interview on 8/21/14 at approximately 9:00 AM, the hospital's Privacy Analyst (PA 1) reported that Patient A was seen in the Ophthalmology Clinic on 7/8/14 and a consultation letter was faxed to the wrong Primary Care Provider (PCP).Record review indicated the mis-faxed report contained Patient A's name, medical record number, date of visit, date of birth, examination, impression, and discussion.PA 1 stated the hospital was notified of this error on 7/11/14. PA 1 stated the consult letter was then sent to the correct PCP and a letter was sent to Patient A informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 7/17/14 2:31 PM notifying CDPH of the breach, and a copy of the letter sent to Patient A dated 7/16/14.2. CA00406165 (2014-175)During an interview on 8/21/14 at approximately 9:30 AM, PA 1 reported a clerk in the Radiology Department was stuffing envelopes, and two documents for different patients were included in one envelope. The patient who received the extra report notified the hospital of the mistake on 7/14/14.Record review indicated the mis-mailed report contained Patient B's name, medical record number, date of visit, date of birth, reason for the examination, laboratory result, diagnostic report, impression, and summary.PA 1 stated the radiology report was then sent to the correct PCP and a letter was sent to Patient B informing this patient of the breach of his/her medical information.Record review indicated a faxed report to CDPH dated 7/18/14 at 11:02 AM notifying CDPH of the breach, and a copy of the letter sent to Patient B on 7/18/14.
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights