CA DEPT OF PUBLIC HEALTH CALIFORNIA HtALTH AND HUMAN SERVICES AGENCY DEPARTMENT OF PUBLIC HEALTH

A_ s- 1-

LampC OIVISION SCMbull FAANCI

(XSTATEMENT OF DEFICIENCIES AlIgt PlAN OF CORRECTION

(X1) PROVIDERISUPPLIERICLIA IDENllFICATIDN NUM8ER

050454

(X2) MULTIPLE CONSTRUCTION

A BUILDING

BWING S

3)DATE SURVEY COMPLETED

01182012

NAME OF PROVIDER OR SUPPLIER

UCSF MEDICAL CENTER

STREET ADDRESS CITY STATE ZIP CODE

505 Parnassus Ave San Francisco Ca 94143-2204 SAN FRANCISCO COUNTY

()(4)1D SUMMARY STATEMElIT OF DEFICIENCIES ID PREFIX (EACH DEFICIENCY MUST BE PRECEEDED DY FULL PREFIX

TAG REGULATORY OR LSC IOENTifYING INFORMATION) TAG

The following reflects the findings of the Department of Public Health during a complainUbreach event visit

Complaint Intake Number CA00283181 - Substantiated

Representing the Department of Public Health Surveyor ID 26616 HFEN

The inspection was limited to the specific facility event investigated and does not represent the findings of a full inspection of the facility

Health and Safety Code Section 128015(a) A clinic health fae1lity home health agency or hospice licensed pursuant to Section 1204 1250 1725 or 1745 shall prevent unlawful or unauthorized access to and use or disclosure of patients medlcal Information as defined in subdivision (g) of Section 5605 of the Civil Code and consistent with Section 130203 The department aftlaquo investigation may assess an administrative penalty for a violation of this section of up to twenty-five thousand dollars ($25000) per patient whose medical information was unlawfully or without authorization accessed used or disclosed and up to soventeen thousand five hundred dollars ($17500) per subsequent occurrence of unlawful or unauthorized access use or disclosure of that patients medical information

Violation of Health and Safoty Code 128015(a) for failure to prevent unauthorized access to patients medical records Substantiated

PROV1DEPS PtAN OF CORRECTION (X5)

(EACH CORRECTIVE ACTION SHOULD BE CROSSshy COMPLETE RFFERFNCED TO THE APPROPRIATE DEFICIENCY) DATE

Corrective Action

Immediately upon confinning that the 9711 employee had inappropriately accessed a patients medical record the employee was counseled ~d required to review the I Confidentiality Access Use and Disclosure ofProtected Health lnfonnation and Patient Privacy UCSF Medical Center Policy

A Notice oflntent to Dismiss was issued to 10611 the employee the employee resigned his position prior to his manager taking any further action

All Transfer CenterPatient Placement staff l1712 were re-trained by the manager regarding patient privacy and patient confidentiality including appropriate access of patient medical records protection ofpatient privacy in e-mail exchange protection of inadvertent disclosure ofpatient infonnation during spoken conversation e-mail exchange and protection ofmedical record infonnation including paper and electronic records

Staff in the department review the medical Ongoing center employee confidentiality statement during their annual perfonnance evaluation

4102012 201 35PM

TITLE ( 6) DAfE

51t 2shyy deficiency statement ending with an asterisk () denotes a doficioncy which Iha inslituUon may be excuaed from correcting providing Hiamp detennlned

that other safeguards provide sufficient protection to the patlonts Except for nursing homH Iha findings above are disct0$8ble eo days followlng the date

of survey whether or note plen of ccrreellon is proided For nursing homes Iha abovo findings ond plans ofoorredlon are dlsciosable 14 days followingmiddot tho date these documents ara made available to the facility II deflclenciea Bill cited en approved plan or correction is requisite to continued program

---- -- --middot---- ---shy1 014

participation

State-2567

CAUFORNrA HFAlTH AND HUMAN SERVICES AGENCY CA DEPT OF PUBLIC HEALTH DEPARTMENT OF PUBLIC HEALTH

(X1) PROVIOERSUPPLIERCLIA (X2) MUlTIPLI CONS I KUCTION Q(3 DATE SURVEYSTATEMENT OF DEFICIENCIES IDlNJIF-ICATION NUMBERANO PLAN OF CORRECTION COMPLETEDMAY 1 4 2012

ABUIIDING

BvlNG050454 01182012

NAME OF PROVIDER OR SUPPLIER smEEl ADDRESS c1TY STATEZJP CODamp ~ANFlANCISCO 505 Parnassus Avo San Francisco Ca 94143~2214 SAN FRANCISCO COUNTY UCSF MEDICAL CENTER

()(4) ID SUMMARY STATEMENT OF DEFICIENCIES ID PREFIX EACH DEFICIENCY MUST BE PRECEEDED BY FULL PREFIX

TAG REGULATOHY OR LSC IDENTIFYING INFORMATION) TAG

Continued From page 1

T22 D1V5 CH1 ART7-70707(b)(8) Patients Rights

(b) A list of these patients rights shall be posted in both middot Spanish and English in appropriate places within the hospital so that such rights may be read by patients This list shall include but not be limited to the patients rights to

(8) Confidential treatment of all communications and records pertaining to the care and the stay in the hospital Written permission shall be obtained before the medical records can be made available to anyone not directly concerned with the care

These regulations were not met as evidenced by

Based on interview and record review the facility f11iled to prevent an unauthorized access to Patient As medical information when a staff person (Staff 1) accessed the computerized medical records without the patients consent and without valid justification related to his job

Findings

In an interview on 10311 at 1000AM the Director of Regulatory Affairs said Patient A reported to the facility that a facility staff

PROVIDERS PLAN OF CORRECTION (X5) (EACH CORRECTM ACTION SHOULD BE CROSSshy COMPLETE fHERENCED TO TrlE APPl-10PfIA 1 E DEFICIENCY) DATE

All employees are required to complete the Ongoing

onlinc competency training on Privacy and Security Briefing annually

Periodic e-mail reminders on lllPPA Ongoing Privacy and Security are disseminated to all employees

Beginning with the January 2012 meeting 1712 amp

the topic of patient privacy is included as an Ongoing agenda item on the quarterly departmental staff meetings

Monitoring 1 9711 amp

I UCSF Medical Center investigates all Ongoing allegations of unauthorized access to medical records

2 UCSF Medical Center conducts random Ongoing

audits for access to High Risk medical

records such as employees forensics VIPs

3 In the event of suspected inappropriate Ong(ing access a real time audit of patient record access is conducted by the UCSF Medical Center Privacy Office

Ongoing4 Following implementation ofthe new

EMR UCSF Medical Center will be

expanding auditing and monitoring capabilities

Responsible Party Director of Revenue Cycle Chief Privacy Officer

Event IDSD4X11 4102012 20135PM

LABORATORY DIRECTORS OR PROVIDERSUPPLIER REPRESENTATIVES SIGNATURE TITLE (X6DATE

Any deflcioncy statement ending with an asterlsk (middot) denolos a doflclency which the institution may be excused from correcting providing ii la determined that other safeguards provide GUflident protecdon to the patients Except for nursing homos the findings above are disctosable 90 days following the date of survey whother or not a plan of correction Is provided For nursing homes the above findings and plans of correction are dlsclosable 14 days folowing the data these documents are made available to the facility If deficiencies are cilod an approved plan Qf correction is requisite to continued programmiddot

partlcipalion

- middot------- - ---- ------- shySlate-2567 2 of 4

CAUFORNrA HFAlTH AND HUMAN SERVICES AGENCY CA DEPT OF PUBLIC HEALTH DEPARTMENT OF PUBLIC HEALTH

(X1) PROVIOERSUPPLIERCLIA (X2) MUlTIPLI CONS I KUCTION Q(3 DATE SURVEYSTATEMENT OF DEFICIENCIES IDlNJIF-ICATION NUMBERANO PLAN OF CORRECTION COMPLETEDMAY 1 4 2012

ABUIIDING

BvlNG050454 01182012

NAME OF PROVIDER OR SUPPLIER smEEl ADDRESS c1TY STATEZJP CODamp ~ANFlANCISCO 505 Parnassus Avo San Francisco Ca 94143~2214 SAN FRANCISCO COUNTY UCSF MEDICAL CENTER

()(4) ID SUMMARY STATEMENT OF DEFICIENCIES ID PREFIX EACH DEFICIENCY MUST BE PRECEEDED BY FULL PREFIX

TAG REGULATOHY OR LSC IDENTIFYING INFORMATION) TAG

Continued From page 1

T22 D1V5 CH1 ART7-70707(b)(8) Patients Rights

(b) A list of these patients rights shall be posted in both middot Spanish and English in appropriate places within the hospital so that such rights may be read by patients This list shall include but not be limited to the patients rights to

(8) Confidential treatment of all communications and records pertaining to the care and the stay in the hospital Written permission shall be obtained before the medical records can be made available to anyone not directly concerned with the care

These regulations were not met as evidenced by

Based on interview and record review the facility f11iled to prevent an unauthorized access to Patient As medical information when a staff person (Staff 1) accessed the computerized medical records without the patients consent and without valid justification related to his job

Findings

In an interview on 10311 at 1000AM the Director of Regulatory Affairs said Patient A reported to the facility that a facility staff

PROVIDERS PLAN OF CORRECTION (X5) (EACH CORRECTM ACTION SHOULD BE CROSSshy COMPLETE fHERENCED TO TrlE APPl-10PfIA 1 E DEFICIENCY) DATE

All employees are required to complete the Ongoing

onlinc competency training on Privacy and Security Briefing annually

Periodic e-mail reminders on lllPPA Ongoing Privacy and Security are disseminated to all employees

Beginning with the January 2012 meeting 1712 amp

the topic of patient privacy is included as an Ongoing agenda item on the quarterly departmental staff meetings

Monitoring 1 9711 amp

I UCSF Medical Center investigates all Ongoing allegations of unauthorized access to medical records

2 UCSF Medical Center conducts random Ongoing

audits for access to High Risk medical

records such as employees forensics VIPs

3 In the event of suspected inappropriate Ong(ing access a real time audit of patient record access is conducted by the UCSF Medical Center Privacy Office

Ongoing4 Following implementation ofthe new

EMR UCSF Medical Center will be

expanding auditing and monitoring capabilities

Responsible Party Director of Revenue Cycle Chief Privacy Officer

Event IDSD4X11 4102012 20135PM

LABORATORY DIRECTORS OR PROVIDERSUPPLIER REPRESENTATIVES SIGNATURE TITLE (X6DATE

Any deflcioncy statement ending with an asterlsk (middot) denolos a doflclency which the institution may be excused from correcting providing ii la determined that other safeguards provide GUflident protecdon to the patients Except for nursing homos the findings above are disctosable 90 days following the date of survey whother or not a plan of correction Is provided For nursing homes the above findings and plans of correction are dlsclosable 14 days folowing the data these documents are made available to the facility If deficiencies are cilod an approved plan Qf correction is requisite to continued programmiddot

partlcipalion

- middot------- - ---- ------- shySlate-2567 2 of 4

CAUJORNIA Hr=ALTH AND HUIIIAN SERVICES AGENCY DEPARTMENT OF PUBLIC HEALTH

()f1) lkOV1UERSIJllI IH~fIV SJAHMCHT Of 011 tICN(l~S ()(3) 011 SURllEY IC[lfllFlltAllvNNMlllRAllt) llAN Of (OHHCCIION COMPIEIEO

A BUiiDiNG

0504$4 awNG 0111812012

NAMF 0~ PROVIOlR OH SUPPLER

UCSF MEDICAL CENTER

STRSET AOOOE8S CHY STATE llf CODt

50~Pam11a~ An $an Fran~lbullcolta 941~220 SAN FRANCISCO COUNTY

tXbull)IO SUMMARY sr111 ~UlmiddotNI 01 l)fflCl(NCIM~ (EACH tgtEflltIENCY MvnIll ~fflCEEOlO HY fVLL REOIAATOm OR LSC DENTIFtlMO IMFORMlflON)

PREFIX TMJ

Continued From pa99 2

person accessed hill medical lnfomiation Silamp stated the pa1Jent had suspicion about the breach because Staff 1 approached the patient during his clinic appointment~ betweoo Juy and August 2011

The lacllltys repoft lo the Department dated 91311 indicated that on August 25 2011 a patient alleged that a faclllty employee accessed his medlcal record without a buamplness need to do so Thi$ was confirmed on 91712011

A letter sent by the facility to the Department elated 1011111 Indicated the fadllty staff (Staff 1) worked for Central Placement in the Departmont of Admissions and RegistraliM It stated tnet during the fa~litys investlgatCX) meeting the employee stat~ that he ecce~ed the patients medical record for operallonal purposes a1d beeause he was curtoug to find out if he would need to have tne same prooedut~ lhat the patient had He slated they were acquaintances and ueod to be fciends

In a telephone Interview on 121211 at 1150 PM Staff 1 stated his main function on the Job was lo e5Sign bods but he could also eltcess patients medical information liko demographics (date at birth address medlcel record number and emergency contact) appointment time in and out reason for the appolmment diagnosis and doctors recommendations for patients condi1Jons He said prior to Patient As clinic appoin1mcm scmetlme In -2011 he end

lJltOl11)Lllli I N 01 COXlltlCIIOI ()(ti (lACH CORRECTM1ACJION SIIOULO DE CR0$S COUPLETE REFlREtlCEO TO THE AlPROPRIAYE UEFICIENCY) 01TE

CA DEPT OF PUBLIC HEALTH

lIAY 1 4 20l2

LampCDMSION SAN FRANCISCO

411012012 20135PMEvent IOS04X11

LABORATORY DlnFCTORS OR PROIIDERISUPPLIER RlrRESENTA11VES SIGNITJRE Till F (XO)OrF

Alf debnq illlell8llt ending 111111rllI asUldsit n denalea bull d11hxcy wtidl lhD lnltHut~ ray oo ollOUIIOd from eon-octng proYidng II le oelemIMd 11al oit-N1iegullrcl1 plWde ullclonl 1)101ectlon lo Che patients Elccclpt fot nunirno h0m111 Ille flndlngs aooe are tlbdOetllla 90 daya following Che dale of llUMIY whelllar 01 notbullplan of OOlllCll0n II pt(Mdlld Fornvalng hontet lhamp ebolll ln~n9bull 1111d p11111 or -1ioti are di1ltlotlalilo 14 daya fallawlng

Itamp dal8 lllsse (l(lcum~nts ere made a~Mablbull lo the llclllly Ifdeflolondamps a111 dlad Dn al)p0gtild planofoomcUon l$ requlsl~ to contlnuod progmm

partldpalioo

Staft)-2amp17 3ol-

CALIFORNIA HEALTH AND HUIV1AN SERVICES AGENCY DEPARTMENT OF PUBLIC HEALTH

STATEMENT OF DEFICIENCIES ()(1) PROVIOERSUPPLIERICLIA (X2) MULTIPLE CONbTRUCnON ()(3) DATE SURVEY AND Pl-AN OF CORRECTION IDENTIFICATION NUMBER

050454

A BUILDING

BMNCl

COMPLETED

01182012

NAME OF PROVIDER OR SUPPLIER

UCSF MEDICAL CENTER

STREET ADDRESS CITY STATE ZIP COD[

505 Parnassus Ave San Francisco Ca 94143-2204 SAN FRANCISCO COUNTY

(X4) ID SUMIMRY STATEMENT OF DEFICIENCIES 10 PREFIX (EACH DEFICIENCY MUST BE PRECEEDED BY FULL PREFIX

TAO REGULATORY OR LSC IDEIITIFYING INFORMATION) TAG

PROIIIOERS PLAN OF CORRECTION (EACH CORRECTIIIEACTION SHOULD BE CROSSshy

REFERENCED TO THE APPROPRIATE DEFICIENCY)

(X5)

COMPLETE OAIE

Continued From page 3

Patient A agreed that they will have lunch after his appointment He said he and Patient A were old friends He said that he was trying to contact Patient A but he was not middot answering his phone so he looked in the computer what time he came in and out of the clinic He said that Patient A had suspected him that he looked at the medical information because he knew about the doctors appointment When asked if he accessed Patient As medical information he said I did look at the doctors recommendations for his condition because I had ~e same condition as him He said he never middot told Patient A that he looked at his medical record but he admitted to the facility during the investigation regarding the breach

Review of Staff 1s Job Description indicated Bed Control Coordinator duties include procuring the assignment of beds from nursing units for incoming patients tracking patient flow throughout the hospital and performing census reconciliation

The employees action to access the patients medical information for improper purpose violated Health and Safety Code 128015(a) and is therefore subject to the applicable penalty assessment

CA DEPT OF PUBLIC HEALTH

1AY 1 4 2012

LampC DIVISION SAN FRANCISCO

Event1DSD4X11 4102012 20135PM

LABORATORY DIRlCTORS OR PROVIDERSUPPLIER REPRESENTATIVES SIGNATURE TtnF (XS) DATE

Any deficiency statement ending with an asterisk () donates a delkiency Which the instituUon may be excused from correcting provilling it Is determined that other safeguards provide sufficient protection to the paUents Except ror nursing homes the findings above are dlsclosable 90 days following the date of suNey whether or not a plan of COfT9Cllon Is provided For nu111ing homea the above findings and plans of correction are discloaable 14 days follCMng the date these documents are msdo available lo tho fecllty If doflclenclea are cited an approved plan of correction Is requisite to conUnued program

participation

middot---------- ----middotmiddotmiddot---- __ ______ ------shyStato-2567 4 ofJ