Search Privacy Violations, Breaches and Complaints
This database was last updated in December 2015 ago and should only be used as a historical snapshot. More recent data on breaches affecting 500 or more people is available at the U.S. Department of Health and Human Services’ Breach Portal.
UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER
Cited by the California Department of Public Health for violations of California’s Health and Safety Code relating to medical privacy during an inspection that began on July 3, 2014. Also cited in 108 other reports.
Report ID: THEB11.03, California Department of Public Health
Reported Entity: UCSF MEDICAL CENTER
Issue:
Based on interview and record review, the facility failed to maintain the confidentiality of protected health information when such information was mailed to another patient (patient 1, patient 4, patient 5).Findings for CA00400407: During an interview on 7/3/14 at 9:00AM, Risk Manager stated, "The patient involved had visited the Urology Clinic on May 24, 2014. An "After Visit Summary" was inadvertently mailed to another patient. The patient whose health information was sent to another patient was notified by letter by the manager of the Urology Clinic. Staff 1, who was responsible for this error was temporary staff, who was verbally retrained and not rehired.Record review on 7/3/14, at 9:30 AM, indicated, "the information in the "after visit summary" contained the patient's name, date of birth, date of service, and some health information. It did not contain the social security number or any other personal or financial information for this patient."During an interview on 7/3/14 at 9:45 AM, the Risk Manager stated, "the letter sent to the wrong patient was destroyed."During an interview on 7/3/14 at 10:00 AM, Risk Manager stated, "the facility was aware of the error on 5/27/14. The notification to the patient of the breach of his/her medical information was sent on 5/30/14."Record review of the facility's Fax Transmittal Sheet, dated 5/30/14, indicated notification of the breach to CDPH. An attached copy of the letter, dated 5/30/14, was sent to the patient. The facility was in compliance with the reporting timeframe. Findings for CA00399880:During an interview on 7/3/14 at 10:30 AM, Risk Manager stated, "The patient involved had visited the Cancer Center on February 28, 2014. An "After Visit Summary" was inadvertently mailed to another patient. The patient whose health information was sent to another patient was notified by letter by the manager of the Comprehensive Cancer Center. Staff 4 who was responsible for this error was re-educated and signed and acknowledged a confidentiality agreement.During an interview on 7/3/14 at 11:00 AM, the Risk Manager stated, "the letter sent to the wrong patient was destroyed."During an interview on 7/3/14 at 11:10 AM, Risk Manager stated, "the facility was aware of the error on 5/21/14. The notification to the patient of the breach of his/her medical information was sent on 5/27/14."Record review of the facility's Fax Transmittal Sheet, dated 5/27/14, indicated notification of the breach to CDPH. An attached copy of the letter, dated 5/27/14, was sent to the patient. The facility was in compliance with the reporting timeframe.Findings for CA00400017:During an interview on 7/3/14 at 11:45 AM, Risk Manager stated, "The patient involved had visited the Pathology Center on May 20, 2014. A pathology review cover letter was inadvertently mailed to an incorrect health care provider. The patient whose health information was sent to an incorrect health care provider was notified by letter by the manager of the department of pathology. Staff 5, who was responsible for this error was re-educated and signed a acknowledged a confidentiality agreement.Record review on 7/3/14, at 12:00 Noon, indicated, "the information in the pathology cover letter and tissue samples contained the patient's name and date of birth, It did not contain the social security number or any other personal or financial information for this patient."During an interview on 7/3/14 at 12:05 PM, the Risk Manager stated, "the letter sent to the incorrect health care provider and tissue samples was returned to UCSF."During an interview on 7/3/14 at 12:15 PM, Risk Manager stated, "the facility was aware of the error on 5/22/14. The notification to the patient of the breach of his/her medical information was sent on 5/27/14."Record review of the facility's Fax Transmittal Sheet, dated 5/28/14, indicated notification of the breach to CDPH. An attached copy of the letter, dated 5/27/14, was sent to the patient. The facility was in compliance with the reporting timeframe.
Outcome:
Deficiency cited by the California Department of Public Health: Patients' Rights