UNIVERSITY OF CALIFORNIA SAN FRANCISCO MEDICAL CENTER

Report ID: 28LU11, California Department of Public Health

Reported Entity: UCSF MEDICAL CENTER

Issue:

Based on interview and record review, the hospital failed to maintain the confidentiality of protected health information (PHI) when:1. Patient 1's consultation letter was faxed to an incorrect healthcare provider;2. Patient 2's consultation letter was faxed to the wrong provider;3. Patient 3's insurance authorization request was faxed to an unrelated private residence;4. Patient 4's appointment schedule and progress notes were faxed to an incorrect recipient;5. Patient 5's consultation letter was faxed to an incorrect provider;6. Patient 6's consultation letter was faxed to the wrong provider;7. Patient 7's After Visit Summary was handed to another patient; and8. Patient 8's embryo photograph was handed to another patient.These mistakes in handling the patients PHI had the potential for embarrassment to the patients when personal information was shared, and the potential for identity theft at a future date.Findings: 1. CA00408407 (2014-187) During an interview on 9/15/14 at approximately 10:15 AM, the hospital's Privacy Analyst, (PA 1) stated that the clerk who registered Patient 1 had selected an incorrect referring physician and the consultation letter was automatically sent to this physician. PA 1 said the hospital was notified of this mistake on 7/31/14. Record review indicated a copy of the consultation letter which contained the following PHI for Patient 1: name, medical record number, date of birth, date of visit, patient history, review of systems, physical examination, test results, assessment and plan of care. Record review indicated a faxed letter, dated 8/5/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 1's medical information. Record review indicated a copy of a letter, dated 8/5/14, notifying Patient 1 of the breach of his/her medical information.2. CA00408412 (2014-188)During an interview on 9/15/14 at approximately 9:00 AM, the hospital's Privacy Analyst, (PA 2) stated that Patient 2's consultation letter was sent to an old address for the referring provider and was received by a provider not authorized to receive this information. PA 2 said the hospital was notified of this mistake on 7/30/14. Record review indicated a copy of the consultation letter which contained the following PHI for Patient 2: name, date of birth, date of visit, family history, assessment and plan of care. Record review indicated a faxed letter, dated 8/5/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 2's medical information. Record review indicated a copy of a letter, dated 8/5/14, notifying Patient 2 of the breach of his/her medical information. 3. CA00408418 (2014-189) During an interview on 9/15/14 at approximately 9:15 AM, PA 2 stated that Patient 3's insurance authorization request was faxed to a private residence by mistake. PA 2 said the occupant notified the hospital of this error on 7/30/14.Record review indicated a copy of the authorization request which contained the following PHI for Patient 3: name, date of birth, insurance ID, diagnoses, history, progress notes, medication being requested. Record review indicated a faxed letter, dated 8/5/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 3's medical information. Record review indicated a copy of a letter, dated 8/5/14, notifying Patient 3 of the breach of his/her medical information.4. CA00408496 (2014-191)During an interview on 9/15/14 at approximately 9:15 AM, PA 2 stated that Patient 4's appointment schedule and progress notes were faxed to the wrong provider who was not authorized to receive this information. PA 2 said the occupant notified the hospital of this error on 7/30/14.Record review indicated a copy of the authorization request which contained the following PHI for Patient 4: name, age, sex, date of service, history, family history, social history, medications, review of systems, physical examination, prior test results, assessment and plan. Record review indicated a faxed letter, dated 8/6/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 4's medical information. Record review indicated a copy of a letter, dated 8/6/14, notifying Patient 4 of the breach of his/her medical information. 5. CA00408499 (2014-190)During an interview on 9/15/14 at approximately 10:30 AM, PA 1 stated that the consulting physician faxed the Patient 5's consultation letter to an unauthorized recipient who had the same last name as the intended recipient. PA 1 said the hospital was notified of this mistake on 7/31/14. Record review indicated a copy of the consultation letter which contained the following PHI for Patient 5: name, medical record number, date of birth, date of visit, patient history, diagnoses, review of systems, physical examination, test results, assessment and plan of care. Record review indicated a faxed letter, dated 8/6/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 5's medical information.Record review indicated a copy of a letter, dated 8/6/14, notifying Patient 5 of the breach of his/her medical information.6. CA00408847 (2014-192) During an interview on 9/15/14 at approximately 10:45 AM, PA 1 stated that Patient 6's consultation letter was faxed to an unauthorized recipient who had the same last name as the intended recipient. PA 1 said the hospital was notified of this mistake on 8/4/14. Record review indicated a copy of the consultation letter which contained the following PHI for Patient 6: name, medical record number, date of birth, date of visit, assessment and plan of care. Record review indicated a faxed letter, dated 8/8/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 6's medical information.Record review indicated a copy of a letter, dated 8/8/14, notifying Patient 6 of the breach of his/her medical information. 7. CA00409141 (2014-194)During an interview on 9/15/14 at approximately 10:30 AM, PA 1 stated that Patient 7's After Visit Summary was handed to an unauthorized recipient being seen in the same clinic. PA 1 said the hospital was notified of this mistake on 8/7/14. Record review indicated a copy of the consultation letter which contained the following PHI for Patient 7: name, medical record number, date of birth, sex, date of visit, medications, immunizations, and upcoming appointments. Record review indicated a faxed letter, dated 8/11/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 7's medical information.Record review indicated a copy of a letter, dated 8/7/14, notifying Patient 7 of the breach of his/her medical information. 8. CA00409280 (2014-195) During an interview on 9/15/14 at approximately 9:45 AM, PA 2 stated that Patient 8's photograph of her fertilized embryo was mis-filed in another patient's record and the photograph was then given to this unauthorized recipient. PA 2 said the hospital was notified of this error on 8/12/14.Record review indicated a copy of the consultation letter which contained the following PHI for Patient 8: name, date of birth, and lab cycle number.Record review indicated a faxed letter, dated 8/12/14, notifying the California Department of Public Health (CDPH) of the breach of Patient 8's medical information.Record review indicated a copy of a letter, dated 8/12/14, notifying Patient 8 of the breach of his/her medical information

Outcome:

Deficiency cited by the California Department of Public Health: Patients' Rights