THE WELCH COMPANY
440 Davis Court #1602
San Francisco, CA 94111-2496
415 781 5700
S U M M A R Y
DIARY: May 29, 2008 08:30 AM Thursday;
Millie meeting UCSF 4th cycle cetuximab Carboplatin treat IBC.
2...Security Services Disrupt Work Cafeteria Seating Dispute
3...Work Disrupted Cafeteria Seating Dispute UCSF Security Services
4...Cafeteria Seating Dispute UCSF Security Services Disrupts Work
5...Confidentiality UCSF Security Svcs Investigate Working Efficiently
............UCSF Fund Raising HIPAA Violations Medical Identify Online
............Medical Identify Theft UCSF Fund Raising HIPAA Violations
............6,000 UCSF patients' data got put online
6...Context Unattended Computer Presented Minimal Risk Patient Privacy
7...Patient Assistant Role Doctor Patient Partnership Knowledge Management
8...Knowledge Management Capturing Record New Way Working Not Familiar
9...Meeting Practice Manager Breast Care Clinic Review Patient Privacy
10...Schedule Meeting with Doctor Example Patient Alleged Violation HIPAA
11...HIPAA Protects Patient Privacy from Disclosure by Hospital Doctor
12...Patient Lawfully Empowered Discretion Disclose Medical Records to Anyone
13...UCSF Decides to Verify Patient Assistance Role Manage Medical History
14...Patient Interviewed During Treatment About HIPAA Violations
Click here to comment!
Meeting Examination Doctor Review Strategy Work Plan 4th Cycle 1st T
1403 - ..
1404 - Summary/Objective
140501 - Follow up ref SDS D1 0000. ref SDS A4 0000.
140507 - ..
1408 - Progress
140901 - Sent a letter yesterday with the agenda. ref SDS D7 U45H
140907 - ..
140908 - Millie went to the 5th floor Infusion Clinic for the blood draw this
140909 - morning, needed for meeting with the medical team on the 2nd floor.
140911 - ..
140912 - Megan forgot to bring the blood draw order to the 5th floor. Diane
140913 - was wonderful. She found on the computer the scope for the prior
140914 - blood draw and used that for today, since she knows Millie gets the
140915 - same test every week for the past 18 months.
140917 - ..
140918 - After the blood draw on the 5th floor, Millie went to the 2nd floor to
140919 - meet with the medical team. Megan then saw Millie in the hallway
140920 - prior to the meeting, and while Millie was having vitals taken.
140922 - ..
140923 - Millie asked what happened to the order for the blood draw this
140924 - morning?
140926 - ..
140927 - Megan advised that Jackie called her to explain everything needed for
140928 - Millie's treatment today. Jackie did not forward the letter to Megan
140929 - that was submitted to UCSF yesterday, and sets out the scope of work,
140930 - ref SDS D7 U45H, so Megan relied on conversation that seems fast and
140931 - easy. Megan said the order for Millie's blood draw on the 5th floor
140932 - was taken by mistake to the 1st floor lab.
140934 - ..
140935 - Megan then went to the 1st floor lab and returned in 10 minutes with
140936 - the order for Millie's blood draw, including vials for study tests.
140938 - ..
140939 - Millie asked why there were only 2 vials for the study blood draw
140940 - test, when past blood draws starting a new cycle, like today, have
140941 - always used 7 vials?
140943 - ..
140944 - Megan left the meeting and returned in a few minutes. She seemed to
140945 - explain having called Jackie again and gotten clarification that the
140946 - initial 2 vials were bigger than each of the 7 vials, and so the
140947 - actual quantity of blood would be the same, or otherwise adequate.
140948 - Sounded like Jackie explained that the study team needs blood in 7
140949 - vials, so UCSF practice has been to provide blood in the manner
140950 - required. Megan indicated that continuity with prior practice using 7
140951 - vials for the study blood test should be maintained. She left the
140952 - meeting again and returned in about 10 minutes with 7 vials for
140953 - Millie's study blood draw in the Infusion Clinic after meeting with
140954 - the medical team.
140956 - ..
140957 - Lynn did the examination today, filling in for Brigid, who is on
140958 - military assignment for reserve duty the next 3 weeks.
140962 - ..
140963 - Lynn was terriffic. Like Megan, Lynn had not received Millie's
140964 - letter, ref DIP 2 0001, sent to the medical team yesterday, for
140965 - guiding work during the meeting today. ref SDS D7 U45H
140967 - [On 080821 Lynn filled in again for Brigid, and remembered
140968 - Millie from today. ref SDS E9 GY3N
140970 - ..
140971 - Lynn took immediate action to correct the problem. She paused the
140972 - meeting and left the examination room to check for the letter. This
140973 - applies industry standards to invest time for productive meetings,
140974 - shown in the study on 960205 that found people waste 70% of the day in
140975 - unproductive meetings, because nobody has time to be prepared.
140976 - ref SDS 2 5902
140978 - [On 080821 Lynn did not get the agenda for the meeting again,
140979 - and did not have time to request the list from the medical
140980 - team. ref SDS E9 QH4I
140982 - ..
140983 - Lynn returned and reported that nobody had time to forward the letter
140984 - to her. Lynn provided an address for timely communication on follow
140985 - up, with the understanding that Brigid will likely do the next
140986 - examination in 4 weeks, after she completes her reserve military duty.
140988 - ..
140989 - Lynn asked what was in the letter sent yesterday?
140991 - ..
140992 - Millie advised that the letter asks about NEUTS in the blood test this
140993 - morning. that influences decisions on approving treatment with
140994 - Carboplatin chemotherapy, and further affects requirements for
140995 - additional treatments with Neupogen, along with increasing exercise to
140996 - replenish blood supply. ref SDS D7 IJ5P
140998 - ..
140999 - Lynn commented that looking through the medical chart she could not
141000 - find labs entered for several prior tests. She opened Millie's
141001 - medical records on the UCSF computer and looked through prior lab
141002 - reports. Lynn decided to invest time this morning to fill in missing
141003 - information. This helps address issues noted by Doctor Rugo during
141004 - the meeting on 080219, so that when the doctor checks the record,
141005 - patient history is available to guide the work. ref SDS C0 L18L
141007 - [On 080724 Brigid cannot find CT test in the medical chart.
141008 - ref SDS E8 TG96
141010 - ..
141011 - Megan assisted Lynn filling in the missing data by reading from the
141012 - computer screen and correlating with cycle numbers, treatment numbers
141013 - and dates of treatments. Missing data today may relfect that
141014 - beginning on 080313 Millie now gets blood tests every week, but only
141015 - sees the medical team every 4 weeks, as planned in the meeting on
141016 - 080306. ref SDS C2 NW9L It was not clear today whether the medical
141017 - chart problems extended back for more than just the current cycle.
141019 - [On 080821 Lynn again entered data from the UCSF computer
141020 - system reporting prior blood tests which were missing from the
141021 - medical chart. ref SDS E9 4B6J
141023 - ..
141024 - Megan explained there is a mistake filling out something in the
141025 - Chemotherapy Orders for starting the new cycle today. After studying
141026 - the Chemotherapy Order for a few mintues, Lynn said something is
141027 - confusing. Lynn asked Megan to hand write on the order "error" and
141028 - enter initials and today's date in the Chemotherpy Orders document.
141029 - There was no explanation of the error.
141031 - ..
141032 - [On 080605 Diane in the Infusion Clinic submitted the
141033 - Chemotherapy Orders prepared and dated today, 080529, by Lynn
141034 - and Megan; there is a "Received" stamp and the date 080602;
141035 - Diane noted a handwritten comment of "error" on the entry that
141036 - lists the amount of chemotherapy treatment, which was reduced
141037 - from 250 mg to 175 mg, ref SDS E0 JN38; the Chemotherapy Orders
141038 - today received on 080605 are listed in the record of treatment
141039 - today for continuity. ref SDS D9 I66I
141041 - ..
141042 - [On 080625 Millie asks medical team about error in Chemotherapy
141043 - Orders disclosed today by UCSF. ref SDS E5 PQWV
141045 - ..
141046 - After updating the medical chart and correcting the Chemotherapy
141047 - Orders, Lynn showed results for the blood test this morning. They
141048 - were already posted in the computer, showing timely work by the lab
141049 - this morning, aided by timely blood draws in the Infusion Clinic from
141050 - the patient arriving early, per above. ref SDS 0 4E5J
141052 - ..
141053 - Millie's blood counts were good today NEUTS 2.26, a big jump from 0.96
141054 - last week. ref SDS D5 QY6H This was terrific news, because low blood
141055 - counts have been problematic for this account, reported on 080501.
141056 - ref SDS D1 M653
141058 - ..
141059 - There was consideration during the meeting that Neupogen treatment may
141060 - not be needed. For example, change in diet this past week may have
141061 - contributed to higher counts. Lynn commented that NEUTS 2.26 shows
141062 - favorable results from Neupogen treatment, but Millie's record of
141063 - persistant low blood counts the past 3 months without Neupogen offer
141064 - no grounds to expect blood counts can be maintained without continuing
141065 - treatment.
141067 - ..
141068 - Lynn prescribed 1 Neupogen treatment per week for the 4th cycle, and
141069 - starting on Saturday, 080531. Lynn explained that continuing Neupogen
141070 - will help ensure that the next treatment with Carboplatin scheduled
141071 - for next Thursday on 080605 will be given. Prescribing 1 Neupogen
141072 - treatment today starting the 4th cycle aligns with prior work on
141073 - 080501 prescribing 1 Neupogen treatment per week for the 3rd cycle.
141074 - ref SDS D1 M658
141076 - ..
141077 - Lynn made an examination to update findings from examination on
141078 - 050501,
141082 - ..
141083 - When the meeting ended today, Lynn did not follow past practice and
141084 - submit Chemotherapy Orders, discussed and edited during the meeting,
141085 - along with blood vials for Millie to take to the Infusion Clinic on
141086 - the 5th floor. Lynn explained the Chemotherapy Orders needs more work
141087 - to avoid confusion and ensure accuracy prescribing treatment. Megan
141088 - will deliver the Chemotherapy Order for Carboplatin to the 5th floor
141089 - later today in time for Millie to get chemotherapy after treatment
141090 - with cetuximab which can proceed immediately.
141092 - ..
141093 - [...during treatment in the Infusion Clinic after meeting with
141094 - the medical team today, Megan must have delivered the blood
141095 - vials, because the nurse drew blood needed for the clinical
141096 - study; the nurse further confirmed Lynn's prescription for 1
141097 - treatment with Neupogen, and clarified that treatment should be
141098 - on Sunday, 080601, rather than Saturday. ref SDS D9 TE6N
141100 - ..
141101 - [On 080605 NEUTS 1.55 barely above minimum 1.50 target range
141102 - sufficient for safe chemotherapy treatment; nurse reports that
141103 - Chemotherapy Orders dated 080529 and marked received by the
141104 - Infusion Clinic on 080602 show prescription for 2 Neupogen
141105 - treatments each week of chemotherapy on day 2 and day 3, which
141106 - may mean Friday and Saturday, or Saturday and Sunday.
141107 - ref SDS E0 JN3K
141109 - ..
141110 - [On 080605 Millie's letter to Diane in the Infusion Clinic
141111 - asking for the Chemotherpay Orders dated today (080529), and
141112 - showing 2 treatments per week prescribed for Neupogen, because
141113 - Millie did not "get the word" and took only 1 Neupogen
141114 - treatment. ref SDS E1 JO9Q
141116 - ..
141117 - [On 080612 NEUTS 3.77 blood counts rise significantly with 2
141118 - Neupogen treatments, as prescribed by UCSF. ref SDS E3 PU6K
141120 - ..
141121 - Planning to upgrade the port catheter to a Power Port reported by
141122 - Kaiser on 080523, ref SDS D6 MG6F, was not discussed during the
141123 - meeting today, because Lynn did not get the letter on this issue
141124 - submitted to UCSF yesterday, ref SDS D7 IJ6W, as related above.
141125 - ref SDS 0 4E69
141127 - ..
141128 - Lynn asked Millie if she received a printed report from the staff at
141129 - the front desk showing her current medications, based on the meeting
141130 - last month when Brigid discussed this with Millie, reported 080501?
141131 - ref SDS D1 QK4G
141133 - ..
141134 - Millie reported she did not receive a list of current medications at
141135 - the front desk this morning.
141137 - ..
141138 - Lynn apologized for this mistake, saying things have been hectec,
141139 - which slows and disrupts case management.
141141 - ..
141142 - Lynn seemed to indicate UCSF wants patients to examin the printed
141143 - list, enter changes based assumptions from remembering all of the
141144 - prescriptions, and then sign the report for UCSF records. This aligns
141145 - with understandings from the meeting with Brigid on 080501.
141146 - ref SDS D1 9F5O
141148 - [On 080502 Millie received a list of Current Medications
141149 - maintained on Kaiser's computer. ref SDS D2 IE6M
141151 - ..
141152 - Megan discussed scheduling the next CT test. She asked when the last
141153 - test was performed and how many weeks are planned between tests?
141155 - [On 080605 Millie's letter to UCSF confirms understandings
141156 - today that Kaiser plans surgery to implant Power Port in time
141157 - for next CT test in mid-July. ref SDS E1 634V
141159 - ..
141160 - Patient history shows the last test was on 080425, ref SDS C8 9W9I,
141161 - which was 12 weeks after the previous test on 080212. ref SDS B8 FP5H
141162 - The report for the test on 080425 was reviewed on 080428. ref SDS C9
141163 - 6V5I On 071007, UCSF was asked to change CT test frequency from 8 to
141164 - 12 weeks in order to save money and reduce injury from needle
141165 - punctures injecting contrast medium. ref SDS B2 465H Since CT tests
141166 - for several years showed no progression of disease, ref SDS B2 S68Q,
141167 - on 071009 the doctor got permission from clinical study management to
141168 - extend testing from 8 to 12 week intervals. ref SDS B3 985H
141170 - ..
141171 - On 080207 UCSF ordered expedited CT testing to assess rising
141172 - adenopathy reported in the test on 071210. ref SDS B7 GH5M As a
141173 - result the CT test was done a few days later on 080212. ref SDS B8
141174 - FP5H This test was reviewed on 080215 and indicated rising adenopathy
141175 - in the right axilla. ref SDS B9 J85H On 080219 the doctor cited the
141176 - test on 080212 to determine progerssion of disease that requires
141177 - increased treatment, moving Millie to the 2nd arm of the clinical
141178 - trial study by adding Carboplatin to cetuximab treatments for her IBC
141179 - disease.
141181 - ..
141182 - Millie asked during the meeting today about doing the next CT test on
141183 - the 8 week schedule based on concerns from the test on 080212? The
141184 - next CT test was on 080425, ref SDS C8 L86Y, 12 weeks after the test
141185 - on 080212, and assessed results from increasing treatment, begun on
141186 - 080313.
141188 - ..
141189 - Since the last test was on 080425, an 8-week test schedule requires
141190 - the next CT test on 080620, about 3 weeks from today. Testing on or
141191 - about 080620 would provide time for Kaiser to write and distribute the
141192 - test report, and for the medical team to review the report in order to
141193 - prepare for the meeting to start the next cycle on 080626.
141195 - ..
141196 - The 12-week schedule puts the next CT test on or about 080718, which
141197 - allows time to prepare for the meeting to start the next cycle on
141198 - 080724.
141200 - ..
141201 - The primary care physician at Kaiser has been coordinating with the
141202 - surgeon to plan a meeting for scheduling work to upgrade the port
141203 - catheter to a Power Port. This was discussed with Brigid 4 weeks ago
141204 - at UCSF on 080501. ref SDS D1 766K The next day work began to
141205 - coordiante with the surgery department to perform the work.
141206 - ref SDS D2 VG5J Kaiser has not had time to schedule the work. If
141207 - the next CT test is just 3 weeks away, this may present a scheduling
141208 - challenge for Kaiser and the surgeon. Doing the next test on the
141209 - 12-week schedule affords more time for completing work on the Power
141210 - Port.
141212 - [On 080605 Millie's letter to UCSF confirms understandings
141213 - today that Kaiser plans surgery to implant Power Port in time
141214 - for next CT test in mid-July. ref SDS E1 634V
141216 - ..
141217 - [On 080606 meeting at Kaiser to schedule surgery upgrading
141218 - port catheter to Power Port in time for next CT test OA 080718.
141219 - ref SDS E2 IT8V
141221 - ..
141222 - [On 080617 Power Port surgery scheduled on 080708.
141223 - ref SDS E4 3C7N; CT test using Power Port scheduled 10 days
141224 - later on 080718 1100. ref SDS E4 DF55
141226 - ..
141227 - [On 080708 Millie gets surgery for Power Port. ref SDS E7 IT77
141229 - ..
141230 - We wanted to discuss Millie's occassional spike in pulse, reported in
141231 - the record on 080507, ref SDS D3 PQ5L, and in relation to CT test
141232 - reports of heart issues. ref SDS D3 CK4K This was not discussed,
141233 - because nobody could remember the issue, after helping Lynn get up to
141234 - speed on Millie's patient history.
141236 - ..
141237 - Lynn noted there is no evidence of Cellulitis on Millie's left arm,
141238 - which correlates with Millie completing the 10-day treatment with
141239 - Keflex prescribed by Kaiser on 080520. ref SDS D4 1K7H This verifies
141240 - Millie's report to the medical team yesterday on 080528 about good
141241 - progress recovering from Cellulitis. ref SDS D7 IJ5V
141243 - [On 080627 primary care physician examination at Kaiser finds
141244 - no evidence of Cellulitis nor lymphedema. ref SDS E6 PU6J
UCSF Security Services Investigate HIPAA Complaint Patient Privacy B
4004 - 1240
400501 - ..
400502 - Security Services Disrupt Work Cafeteria Seating Dispute
400503 - Work Disrupted Cafeteria Seating Dispute UCSF Security Services
400504 - Cafeteria Seating Dispute UCSF Security Services Disrupts Work
400505 - Confidentiality UCSF Security Svcs Investigate Working Efficiently
400507 - After taking Millie her lunch, on returning to the cafeteria, Peter
400508 - Balesteri was discovered walking up the stairs carrying c15 in some
400509 - disarray.
400511 - ..
400512 - Peter was asked to explain this taking of customer property?
400514 - ..
400515 - Peter identified himself as Director of the UCSF Medical Center
400516 - Security department.
400518 - ..
400519 - Peter related that the Security department received a call reporting
400520 - an unattended computer and medical documents in the cafeteria. Peter
400521 - seemed to indicate the complaint was filed by a doctor, administrator,
400522 - or manager who was worried about UCSF employees making unauthorized
400523 - disclosure of patient data. This part of the report was unclear, as
400524 - to whether a cafeteria patron reported another customer suspiciously
400525 - viewing computer data and documents which belonged to someone else.
400526 - Peter came to the cafeteria to investigate, and arrived in time to
400527 - prevent theft of the computer and documents.
400529 - ..
400530 - Peter said UCSF procedures require security officers to write up an
400531 - "incident" report.
400533 - ..
400534 - Peter advised that he did not inquire from the person who called why
400535 - someone would be examining a computer screen that was turned in a way
400536 - which requires walking behind a table positioned in the corner of the
400537 - room so that only someone using the computer can see the screen? This
400538 - would be extremely suspicious conduct that would justify cafeteria
400539 - patrons reporting potential theivery.
400541 - ..
400542 - Since the computer is configured with security to go blank within a
400543 - few minutes of non-use. How would anyone see anything on the computer
400544 - screen? Did someone press a key on a computer that did not belong to
400545 - them? This would be extremely suspicious conduct? What did the UCSF
400546 - Security Services investigation learn about who did this, and what was
400547 - discovered by illegal conduct?
400549 - ..
400550 - Peter claimed to have waited 10 minutes in the cafeteria for someone
400551 - to return and resume work with the computer. Durng this time he
400552 - examined the computer and observed confidential patient health care
400553 - data. There was no explanation of how information on the computer
400554 - screen can be seen when the screen goes blank and requires a
400555 - confidential password to access the display? The logon security
400556 - splash screen also displays the name of the person authorized to use
400557 - the computer.
400559 - ..
400560 - Peter did not cite any authority for UCSF Medical Center Security
400561 - forces to examine confidential patient health care data, nor any data
400562 - belonging to UCSF patients. What procedures guide security personnel
400563 - conduct to protect privacy of UCSF customers?
400565 - ..
400566 - Peter did not explain who in the cafeteria was questioned during his
400567 - 10 minute investigation about suspecious conduct of someone stepping
400568 - behind the table to view a computer screen and rifle through documents
400569 - which everyone knew was wrong, because everyone has seen the same
400570 - person at the same computer in the exactly the same spot every
400571 - Thursday for the past 18 months.
400573 - ..
400574 - The time line in this case seems conflicting.
400576 - ..
400577 - The computer was unattended for only about 10 minutes, while lunch was
400578 - delivered to Millie on the 5th floor. Actually, it took about 5
400579 - minutes to go into the cafeteria and get the soup, because at 1220
400580 - (Millie had asked for lunch at 1230), Jo Ann happened to be in the
400581 - cafeteria, and helping herself to the minestroni soup, which Millie
400582 - had asked for her lunch. Millie knows her from the Wellness Community
400583 - cancer support group. She has difficulty with her leg in addition to
400584 - having cancer, and needed a ride today, so we met her at the Walnut
400585 - Creek BART station at 0530. Helped her with her walker, and so on.
400586 - She just happened to be in the cafeteria at the same time Millie
400587 - wanted lunch.
400589 - ..
400590 - After getting soup and crackers, and standing in line to pay, the
400591 - computer was checked in the lunch room, and everything was okay, so
400592 - this might have about 1225.
400594 - ..
400595 - Lunch was then delivered and this took about 10 minutess, the same
400596 - time Peter recalled was required for his investigation.
400598 - ..
400599 - Someone must have subsequently seen the computer on a table, and then
400600 - somehow examined data on a blank computer screen which was known or
400601 - reasonably should have been know to belong to someone else. This
400602 - person would then have had to make a telephone call. As things go
400603 - these days, it is rare to get through to anyone. Typically people
400604 - have to punch various buttons, are on hold, asked to leave a message.
400605 - Doctors have a lot of difficulty coordinating work by telephone to
400606 - care for patients, reported on 080403. ref SDS C4 IM87 It strains
400607 - credulity to believe that calling about patient privacy gets higher
400608 - priorty than caring for the patient.
400610 - ..
400611 - After the 10 minute investigation, Peter decided to take c15 together
400612 - with the keyboard and all customer documents to his office, despite
400613 - the fact that the customer's partially eaten lunch and coat draped
400614 - over a chair, was in plain sight indicating intent to return
400615 - momentarily.
400617 - ..
400618 - Peter explained he took immediate action to confiscate cafeteria
400619 - customer property for two reasons...
400621 - 1. The San Francisco Chronicle published an article in the
400622 - paper today about confidentiality of patient medical
400623 - records.
400625 - ..
400626 - Peter explained that UCSF policy for confidentiality of patient
400627 - medical records prevents patients from disclosing their own medical
400628 - records based on personnel assessment of risks and opportunities,
400629 - discussed further below. ref SDS 0 C38H
400631 - ..
400632 - 2. Peter believes HIPAA regulations justify UCSF Medical
400633 - Center Security forces to confiscate unattended computers
400634 - and documents with medical information.
400636 - ..
400637 - After this incident, a search could not find any articles in the San
400638 - Francisco Chronicle today dealing with HIPAA, health care, medical
400639 - records privacy, or anything remotely related to such issues.
400641 - [On 090219 1315 HIPPA cited for preventing submission of
400642 - patient medical records to the patient. ref SDS F0 9O6L
UCSF Fund Raising HIPAA Violations 6300 Patient Privacy Violations C
730401 - ..
730402 - UCSF Medical Center Security Department should submit the article
730403 - Peter believes justifies seizing UCSF customer property to complete
730404 - the record in this case showing there was no abuse of authority.
730406 - [On 090219 1315 HIPPA cited for preventing submission of
730407 - patient medical records to the patient. ref SDS F0 9O6L
730409 - ..
730410 - The only recent article found in the Chronicle was about a month ago,
730411 - and pertained to massive and pervasive failure to perform duites which
730412 - UCSF owes to protect patient privacy and confidentiality of medical
730413 - records...
730415 - ..
730416 - UCSF Fund Raising HIPAA Violations Medical Identify Online
730417 - Medical Identify Theft UCSF Fund Raising HIPAA Violations
730420 - 6,000 UCSF patients' data got put online
730421 - Elizabeth Fernandez, Chronicle Staff Writer
730422 - May 2, 2008
730424 - http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/05/02/MNKE10DRGN.DTL
730426 - ..
730427 - (05-01) 17:22 PDT San Francisco -- Information on thousands
730428 - of UCSF patients was accessible on the Internet for more
730429 - than three months last year, a possible violation of
730430 - federal privacy regulations that might have exposed the
730431 - patients to medical identity theft, The Chronicle has
730432 - learned.
730434 - ..
730435 - The information accessible online included names and
730436 - addresses of patients along with names of the departments
730437 - where medical care was provided. Some patient medical
730438 - record numbers and the names of the patients' physicians
730439 - also were available online.
730441 - ..
730442 - The breach was discovered Oct. 9, but the medical
730443 - institution did not send out notification letters to the
730444 - 6,313 affected patients until early April, nearly six
730445 - months later.
730447 - ..
730448 - The consequences of health care data breaches can be
730449 - significant, said experts. Sensitive information can be
730450 - used by employers, health insurers and other entities to
730451 - discriminate. Additionally, thieves can use purloined
730452 - information to obtain medical treatment and prescription
730453 - drugs and to file false medical claims.
730455 - ...
730457 - ..
730458 - The breach spotlights a little-known practice among
730459 - medical institutions to plow the ranks of patients for
730460 - fund raising purposes.
730462 - ..
730463 - Hospitals and other health care providers are turning
730464 - patients into "fundraising free-fire zones," said Dr.
730465 - Arthur Caplan, chairman of the department of medical
730466 - ethics at the University of Pennsylvania School of
730467 - Medicine.
730469 - "The breach is a symptom, but the real ethics challenge is
730470 - the extent to which health care institutions are tracking
730471 - patients and their families for nonmedical reasons - for
730472 - fundraising, marketing, advertising," Caplan said. "I
730473 - don't think people are aware of the degree to which this
730474 - is occurring, whether it's by a hospital or a nursing home
730475 - or a hospice."
730477 - ..
730478 - In January, California began requiring health care
730479 - providers to alert consumers if their medical information
730480 - is breached. Swift notification is considered important so
730481 - consumers can monitor credit reports and bills.
730483 - ..
730484 - According to Joanne McNabb, chief of the California Office
730485 - of Privacy Protection, notice should be given "in the most
730486 - expedient time possible, without unreasonable delay."
730488 - "It's a judgment call, the how and the when part," McNabb
730489 - said. "The idea is to give early warning so that people
730490 - can take defensive action. On the other hand, you don't
730491 - want to needlessly worry people."
730493 - ..
730494 - A federal privacy regulation known as HIPAA, the Health
730495 - Insurance Portability and Accountability Act, sets
730496 - standards to protect personal health information. Health
730497 - care entities are allowed, for fundraising activities, to
730498 - release to business associates - without explicit
730499 - individual authorization - certain demographic
730500 - information, such as names, addresses and dates of
730501 - treatment, but not information about health or health
730502 - care.
730504 - "You cannot provide other information for fundraising
730505 - purposes," said a senior official with the U.S. Department
730506 - of Health and Human Services' Office for Civil Rights.
Context Unattended 10 Minutes Minor Medical Records Schedule Meeting
A60401 - ..
A60402 - Context Unattended Computer Presented Minimal Risk Patient Privacy
A60403 - Patient Assistant Role Doctor Patient Partnership Knowledge Management
A60404 - Knowledge Management Capturing Record New Way Working Not Familiar
A60406 - Peter asked for identification. This was provided showing the name
A60407 - and photograph on the driver's license was the same as the name shown
A60408 - on the login screen of the computer.
A60410 - ..
A60411 - Peter seemed concerned that the computer and documents were left
A60412 - unattended by a UCSF employee.
A60414 - ..
A60415 - Examining customer identification, Peter found no association with
A60416 - UCSF; and, he learned the work being performed with the computer and
A60417 - documents was assisting a UCSF patient perform case management to
A60418 - optimize health care.
A60420 - ..
A60421 - Peter was unaware of the patient's name. This fact established there
A60422 - was no breach of patient identification, and Peter's report of 10
A60423 - minute exposure, ref SDS 0 L252, shows patient privacy in this case
A60424 - was at all times far more secure than UCSF permitted of 3 months
A60425 - exposure in the case reported by the Chronicle on 080502, per above.
A60426 - ref SDS 0 LN7G
A60428 - [On 080605 Millie's letter advises that leaving the patient
A60429 - assistant computer unattended for a few minutes to deliver
A60430 - lunch to a cancer patient getting treatment was not a breach of
A60431 - patient privacy by UCSF, as occurred recently, reported by the
A60432 - Chronical on 080502. ref SDS E1 633Q
A60434 - ..
A60435 - Peter asked why a "patient assistant" would leave a computer
A60436 - unattended for 10 minutes in the cafeteria?
A60438 - ..
A60439 - Millie needed lunch, and follow up on status of treatment in order to
A60440 - plan for going home. Does she need anything, juice, some crackers?
A60441 - Has anything occurred, e.g., treatments, communications, that needs
A60442 - review to support the doctor patient partnership for case management?
A60444 - ..
A60445 - The computer is very heavy. It takes several minutes to assemble the
A60446 - computer, and all of the documents spread out for work, and additional
A60447 - time to re-configure everything in order to resume work. Leaving the
A60448 - computer unattended for a few minutes makes delivering lunch, going to
A60449 - the restroom, going next door to the cafeteria for something to eat or
A60450 - drink, a lot faster and easier than spending 10 minutes assembling,
A60451 - carrying, and re-configuring the work setup for each episode of
A60452 - momentary movement. Leaving the computer unattended with partially
A60453 - eaten meal signals to other customers that the space is taken.
A60455 - ..
A60456 - Accordingly, during this 10 minute period, lunch was delivered to
A60457 - Millie getting treatment on the 5th floor. This has been done
A60458 - approximately 70 times over the past 15 months without incident.
A60460 - ..
A60461 - Peter refused to return the computer. He was beginning to perspire
A60462 - from standing in the middle of the cafeteria stairway, as customers
A60463 - streamed by, holding all the equipment that weighs 20 - 30 pounds in
A60464 - an awkward position with everything in disarray. He seemed hurried
A60465 - from having scooped up equipment, documents, carrying case, and
A60466 - cables, rather than invest another minute to arrange things in a
A60467 - standard configuration with the computer, cables, and documents inside
A60468 - the carrying case.
A60470 - ..
A60471 - Peter said he was not familiar with the patient assistant role. He
A60472 - remained suspicious that a UCSF doctor or staff member had violated
A60473 - Medical Center policy on computer and document security.
A60475 - ..
A60476 - Peter insisted that HIPAA required confiscating or impounding customer
A60477 - property. Peter further related that taking customer property is
A60478 - justified to avoid claims against UCSF in the event someone steals
A60479 - unattended property.
A60481 - ..
A60482 - Peter proposed taking the computer to his office for further
A60483 - investigation.
A60485 - ..
A60486 - While traveling up the elevator, he changed his mind or possibly
A60487 - forgot to press the right button on the elevator, because we
A60488 - eventually wound up back on the first floor.
A60490 - ..
A60491 - Peter then proposed a joint meeting with Millie's doctor to verify the
A60492 - patient assistant role. We went to the 2nd floor Breast Care Clinic.
A60493 - Upon learning that the doctor is out of town today attending a
A60494 - conference, Peter suggested visiting Millie in the Infusion Clinic to
A60495 - verify the patient assistant role. Peter was adament retaining
A60496 - custody of customer property, which he continued to carry in disarray.
A60498 - ..
A60499 - On arriving at the 5th floor Infusion Clinic, Peter realized that
A60500 - visiting a cancer patient to ask for bonifides of a patient assistant
A60501 - can cause emotional stress and anxiety that compounds health maladies.
A60502 - Millie's treatment for anxiety on 080305 supports Peter's analysis and
A60503 - conclusion to avoid patient stress. ref SDS C1 KT4J As a result,
A60504 - Peter decided to go back to the 2nd floor and meet with the Practice
A60505 - Manager to discuss disposition in this matter.
A60507 - ..
A60508 - We then took the elevator back to the 2nd floor, without ever getting
A60509 - off at the 5th floor.
UCSF Invest Hours Investigate Patient Privacy Medical Records Disrup
B00401 - ..
B00402 - Meeting Practice Manager Breast Care Clinic Review Patient Privacy
B00404 - At the Breast Care Clinic on the 2nd floor, Peter asked for the
B00405 - practice manager. He was able to relieve stress and strain by resting
B00406 - the computer, the keyboard, the carrying case and all the documents on
B00407 - the customer counter in the lobby. He was told the Practice Manager
B00408 - person was in a meeting, but would try to pull away in order to meet
B00409 - with Medical Center Security forces.
B00411 - ..
B00412 - Peter decided at this time it was safe to return impounded property to
B00413 - the customer. While waiting for the Practice Manager to arrive, the
B00414 - computer, cables, surge protector, and documents were arranged
B00415 - properly in the carrying case for safe and secure handling.
B00417 - ..
B00418 - About 10 minutes later, Sara Schwab introduced herself as the Practice
B00419 - Manager for the Breast Care Clinic. Peter asked to meet in a
B00420 - confidential room on a matter of privacy and confidentiality for
B00421 - patient medical records.
B00423 - ..
B00424 - Sara led the way through various hallways to her office, which was
B00425 - behind several locked doors. The door to her office was also locked.
B00426 - She used a key which was secured with a coil wrapped around her wrist
B00427 - to open the door to her office.
B00429 - ..
B00430 - Getting into Sara's office through 2 or 3 locked doors accessible only
B00431 - to UCSF staff, colleagues, subordinates, and supervisors demonstrates
B00432 - high priority UCSF gives to patient confidentiality, consistent with
B00433 - public reporting on disclosure of 6,000 patient identies by a UCSF
B00434 - contractor, reported on 080502, per above. ref SDS 0 526J
B00436 - ..
B00437 - Peter related his investigation and findings to Sara, who took notes
B00438 - during Peter's presentation.
B00441 - ..
B00442 - Schedule Meeting with Doctor Example Patient Alleged Violation HIPAA
B00444 - Peter gave an example that he saw a schedule for Millie to meet with
B00445 - the doctor and get treatments over the next few months. He indicated
B00446 - this somehow created a HIPAA violation which would risk the hospital's
B00447 - standing as a top cancer center.
B00449 - [On 080605 Millie's letter to UCSF, including Security Services
B00450 - Department, advised that disclosing patient schedule meeting
B00451 - with the doctor is commonly conveyed to others; seeing the
B00452 - schedule printed on paper is not an objectionable compromise of
B00453 - medical privacy. ref SDS E1 625Y
HIPAA Protects Patient Privacy Disclosure Patient Consent Confidenti
C20401 - ..
C20402 - HIPAA Protects Patient Privacy from Disclosure by Hospital Doctor
C20403 - Patient Lawfully Empowered Discretion Disclose Medical Records to Anyone
C20405 - Peter and Sara were advised that Millie appreciates extra time UCSF
C20406 - invests giving priority to protect patient privacy.
C20408 - ..
C20409 - [On 080605 Millie's letter advises that UCSF has at all times
C20410 - maintained patient privacy. ref SDS E1 633Q
C20412 - ..
C20413 - HIPAA was reviewed on 071009 when UCSF asked Kaiser to threaten the
C20414 - patient with legal reprisals under color of HIPAA, ref SDS B4 JW7M, in
C20415 - order to force payment by the patient to UCSF, ref SDS B4 JW59, which
C20416 - was owed by Kaiser, and was subsequently paid by Kaiser, reported on
C20417 - 071128. ref SDS B5 JZ64 Millie is aware that Kaiser and UCSF
C20418 - management do not condone nor encourage missuse of HIPAA or other
C20419 - regulations. Accordingly, citing HIPAA does not justify confiscating
C20420 - customer property.
C20422 - [On 090219 1315 HIPPA cited for preventing submission of
C20423 - patient medical records to the patient. ref SDS F0 9O6L
C20425 - ..
C20426 - HIPAA vests patients with rights of privacy and confidentiality which
C20427 - health care providers, like doctors, nurses, hosptials, etc., have a
C20428 - duty to honor. Medical practice requires balancing privacy rights
C20429 - against other rights, including the right to timely, effective care.
C20430 - Patients have the right to voluntarily give up some portion of privacy
C20431 - in order to advance their care. Health care Providers are required to
C20432 - honor patient rights to exercise discretion giving up some
C20433 - confidentiality in order to secure better care.
C20435 - ..
C20436 - In this case, UCSF has at all times met its responsibilities to the
C20437 - patient by obtaining written consent to distribute patient health care
C20438 - data to clinical study personnel, reported on 070119, ref SDS 58 1G3K,
C20439 - and supplemental authorization for distribution of biopsy tissue on
C20440 - 070130. ref SDS 60 2O3L In return for giving up some privacy, the
C20441 - patient benefits from better care.
C20443 - [On 080605 Millie's letter advises that UCSF has at all times
C20444 - maintained patient privacy. ref SDS E1 633Q
C20446 - ..
C20447 - Similarly, the patient can exercise discretion telling someone on the
C20448 - bus, at a party, on an airplane, or on national television that they
C20449 - have just come from a meeting with the doctor at UCSF, and get
C20450 - treatment every week at such and such a time. Patient's can tell
C20451 - others that their treatment has been terrific, and they wish everyone
C20452 - could benefit from UCSF's excellent work. Patient disclosure cannot
C20453 - violate patient rights of confidentiality under HIPAA because the
C20454 - patient has the right to exercise discretion. UCSF requires patient
C20455 - consent to disclose patient information, which evidently was violated
C20456 - noted in the Chronical article cited by Peter today, per above,
C20457 - ref SDS 0 526J, but the patient may disclose at will to aid their
C20458 - health care, and is not burdened by constraints that prevent a health
C20459 - care provider from using patient medical records for fund raising, as
C20460 - UCSF did, per above. ref SDS 0 LN52
C20462 - ..
C20463 - Examples abound of patients exercising discretion to disclose personal
C20464 - medical history on the Internet, for example an article published in
C20465 - the March/April 2008 issue of Maim...
C20467 - Women Cancer and Community
C20468 - Blogging Breast Cancer
C20470 - ..
C20471 - The article reports...
C20473 - Thousands of women are sharing their souls to the world - without
C20474 - every leaving their computers. Why are online diaries so
C20475 - popular?
C20477 - July 30, 2005: ...I have been from the very beginning completely
C20478 - sold on the idea that I am going to beat cancer. I don't know
C20479 - when it's going to happen, I don't know how it's going to happen.
C20480 - I just know it.... I know [the hospital social worker is] trying
C20481 - to prepare me for what, statistically, is my probable outcome.
C20482 - But, she doesn't know me. I AM NOT A STATISTIC!
C20484 - ..
C20485 - A growing part of this dynamic "blogosphere" are diaries created
C20486 - by women with breast cancer who share their highly personal
C20487 - journeys-from first diagnosis through treatment, from fears of
C20488 - death to exuberance after a cancer-free checkup. Karen George,
C20489 - who wrote the entries on the previous page, is one of them. Only
C20490 - 30 when she was diagnosed with stage iv breast cancer, she never
C20491 - intended to share her experience with anyone outside her family.
C20493 - ..
C20494 - Patients are entitled to disclose whatever they wish about their
C20495 - health records. Hospitals and health care providers are required to
C20496 - protect confidentiality of patient records, especially avoiding
C20497 - attempts to sell patient records for fund raising reported in the San
C20498 - Francisco Chronicle article, which Peter cited, per above. ref SDS 0
C20499 - LN7G
C20501 - ..
C20502 - Discussed flexibility in this matter?
C20504 - ..
C20505 - Leaving documents with patient data on display and unattended, though
C20506 - not unlawful for the patient, may well cause anxiety and frustration
C20507 - to UCSF employees having lunch in the cafeteria, because they are
C20508 - forced by HIPAA to take stringent precautions that protect patient
C20509 - privacy, shown by the visit with Sara today, who has everything under
C20510 - lock and key, per above. ref SDS 0 H64L
C20512 - ..
C20513 - Since we have gotten through for 18 months without incident, can this
C20514 - issue be addressed by closing the computer case, so that documents are
C20515 - not readily visible, when of necessity the computer is unattended for
C20516 - a few seconds or minutes?
C20518 - ..
C20519 - Would patient property be adequately "attended" if a neighbor at an
C20520 - adjacent table watched the computer, while the customer ran to the
C20521 - cafeteria for a glass of water, say 2 minutes, or to the restroom down
C20522 - the hall for 5 minutes, or take Millie her lunch for 10 minutes?
C20524 - ..
C20525 - What seems to have occurred in this case is that a cafeteria customer
C20526 - got angry because all the tables were taken, or a favorite table was
C20527 - taken, and so filed a complaint to get a place to have lunch.
C20528 - Alternativley, a manager may have walked through the cafeteria and was
C20529 - genuinely worried that a doctor or other UCSF employee had breeched
C20530 - patient confidentiality by leaving data exposed.
C20532 - [On 080605 another UCSF security officer disclosed that UCSF
C20533 - security forces have been investigating Rod for several months
C20534 - due to complaints by cafeteria customers about someone using a
C20535 - computer during lunch time. ref SDS E0 0N44
C20537 - ..
C20538 - How can UCSF Security procedures be accomplished with respect and good
C20539 - faith, and also meet exigencies of patient care? If there is an
C20540 - empty office somewhere outside the cafeteria, this might help relieve
C20541 - tensions.
C20543 - ..
C20544 - Additionally, there can be safety in numbers.
C20546 - ..
C20547 - Most theives are risk averse. Stealing a computer and documents that
C20548 - seem unattended in a crowded room presents risk of being reported, as
C20549 - occurred today, and of discovery, as Peter was discovered today
C20550 - walking away with customer property, per above. ref SDS 0 LD7L How
C20551 - does a theif know if the user is just chatting with people at the
C20552 - adjacent table, or is returning by the planned escape route, again as
C20553 - occurred here? This does not diminish UCSF concerns, nor tarnish
C20554 - timely work by the Security department today, but recognizes balancing
C20555 - forces are at play that justify taking risks diminished by context in
C20556 - order to accomplish effective patient care.
Patient Interviewed UCSF Security Services Verify Patient Assistant
CO0401 - ..
CO0402 - UCSF Decides to Verify Patient Assistance Role Manage Medical History
CO0404 - Peter discussed with Sara warning the patient that the assistant was
CO0405 - not using good judgement leaving a computer and documents with health
CO0406 - care information unattended in the cafeteria. Regardless of HIPAA,
CO0407 - this seemed reckless and irresponsible. Peter mentioned the article
CO0408 - in the San Francisco Chronicle again, per above, ref SDS 0 H46K, that
CO0409 - has everyone at UCSF on pins and needles being extra careful today
CO0410 - about patient health care records. Was unclear if Sara had seen the
CO0411 - article. She recognized Peter's concern.
CO0413 - ..
CO0414 - Suggested that Sara or Peter send an email to Millie's nurse in the
CO0415 - Infusion Clinic. Alternatively, calling the nurse to convey a message
CO0416 - would avoid disrupting patients in a sensitive, weakened emotional
CO0417 - state that occurs with chemotherapy treatment.
CO0419 - ..
CO0420 - Sara seemed to agree that Peter should go to the 5th floor Infusion
CO0421 - Clinic and meet with the patient outside the presence of the patient
CO0422 - assistant, to verify the story, and emphasize the importance of
CO0423 - privacy to the patient.
CO0426 - ..
CO0427 - Patient Interviewed During Treatment About HIPAA Violations
CO0429 - After meeting with Sara, Peter went to the 5th floor and interviewed
CO0430 - Millie. Peter asked the patient assistant to wait in the lobby rather
CO0431 - than provide assistance to the patient, similar to UCSF's work on
CO0432 - 071009, when Kaiser invoked HIPAA to warn the patient to pay money to
CO0433 - UCSF that was owed by Kaiser, cited above. ref SDS 0 H67I
CO0435 - ..
CO0436 - Peter or the nurse pulled the privacy screen closed around Millie's
CO0437 - chair. Since this is the first time in 18 months this precaution has
CO0438 - been taken, and since Peter is with the Medical Center Security
CO0439 - department, Millie recognized the meeting was important.
CO0441 - ..
CO0442 - Peter related the story and efforts by UCSF Medical Center Security
CO0443 - forces to protect Millie's privacy in this case. Millie was impressed
CO0444 - with Peter's courtesy, care, and professionalism explaining sensitive
CO0445 - patient privacy issues.
CO0447 - [On 080605 Millie's letter to UCSF commends Peter and Sara for
CO0448 - timely, effective security support. ref SDS E1 625Q
CO0450 - ..
CO0451 - Peter returned from the meeting, and released the patient assistant
CO0452 - for duty.
CO0454 - ..
CO0455 - Back in the cafeteria, this episode removed about 90 minutes from
CO0456 - doctor patient partnership support for case management. Someone was
CO0457 - using the table. Partially eaten lunch was still at the table. This
CO0458 - was taken to the trash, and another table was used until Millie came
CO0459 - down after her treatment was completed.
CO0461 - ..
CO0462 - Besides 90 minutes working with Medical Center Security staff, another
CO0463 - 60 minutes or so was required to write up the record in order to
CO0464 - guide work going forward.