CONTACTS 

SUBJECTS
Meeting Examination Doctor Review Strategy Work Plan 4th Cycle 1st T

1403 -
1403 -    ..
1404 - Summary/Objective
1405 -
140501 - Follow up ref SDS D1 0000. ref SDS A4 0000.
140502 -
140503 -
140504 -
140505 -
140507 -  ..
1406 -
1407 -
1408 - Progress
1409 -
140901 - Sent a letter yesterday with the agenda. ref SDS D7 U45H
140902 -
140903 -
140904 -
140905 -
140907 -  ..
140908 - Millie went to the 5th floor Infusion Clinic for the blood draw this
140909 - morning, needed for meeting with the medical team on the 2nd floor.
140911 -  ..
140912 - Megan forgot to bring the blood draw order to the 5th floor.  Diane
140913 - was wonderful.  She found on the computer the scope for the prior
140914 - blood draw and used that for today, since she knows Millie gets the
140915 - same test every week for the past 18 months.
140917 -  ..
140918 - After the blood draw on the 5th floor, Millie went to the 2nd floor to
140919 - meet with the medical team.  Megan then saw Millie in the hallway
140920 - prior to the meeting, and while Millie was having vitals taken.
140922 -  ..
140923 - Millie asked what happened to the order for the blood draw this
140924 - morning?
140926 -  ..
140927 - Megan advised that Jackie called her to explain everything needed for
140928 - Millie's treatment today.  Jackie did not forward the letter to Megan
140929 - that was submitted to UCSF yesterday, and sets out the scope of work,
140930 - ref SDS D7 U45H, so Megan relied on conversation that seems fast and
140931 - easy.  Megan said the order for Millie's blood draw on the 5th floor
140932 - was taken by mistake to the 1st floor lab.
140934 -  ..
140935 - Megan then went to the 1st floor lab and returned in 10 minutes with
140936 - the order for Millie's blood draw, including vials for study tests.
140938 -  ..
140939 - Millie asked why there were only 2 vials for the study blood draw
140940 - test, when past blood draws starting a new cycle, like today, have
140941 - always used 7 vials?
140943 -  ..
140944 - Megan left the meeting and returned in a few minutes.  She seemed to
140945 - explain having called Jackie again and gotten clarification that the
140946 - initial 2 vials were bigger than each of the 7 vials, and so the
140947 - actual quantity of blood would be the same, or otherwise adequate.
140948 - Sounded like Jackie explained that the study team needs blood in 7
140949 - vials, so UCSF practice has been to provide blood in the manner
140950 - required.  Megan indicated that continuity with prior practice using 7
140951 - vials for the study blood test should be maintained.  She left the
140952 - meeting again and returned in about 10 minutes with 7 vials for
140953 - Millie's study blood draw in the Infusion Clinic after meeting with
140954 - the medical team.
140956 -  ..
140957 - Lynn did the examination today, filling in for Brigid, who is on
140958 - military assignment for reserve duty the next 3 weeks.
140962 -  ..
140963 - Lynn was terriffic.  Like Megan, Lynn had not received Millie's
140964 - letter, ref DIP 2 0001, sent to the medical team yesterday, for
140965 - guiding work during the meeting today. ref SDS D7 U45H
140966 -
140967 -        [On 080821 Lynn filled in again for Brigid, and remembered
140968 -        Millie from today. ref SDS E9 GY3N
140970 -  ..
140971 - Lynn took immediate action to correct the problem.  She paused the
140972 - meeting and left the examination room to check for the letter.  This
140973 - applies industry standards to invest time for productive meetings,
140974 - shown in the study on 960205 that found people waste 70% of the day in
140975 - unproductive meetings, because nobody has time to be prepared.
140976 - ref SDS 2 5902
140977 -
140978 -        [On 080821 Lynn did not get the agenda for the meeting again,
140979 -        and did not have time to request the list from the medical
140980 -        team. ref SDS E9 QH4I
140982 -  ..
140983 - Lynn returned and reported that nobody had time to forward the letter
140984 - to her.  Lynn provided an address for timely communication on follow
140985 - up, with the understanding that Brigid will likely do the next
140986 - examination in 4 weeks, after she completes her reserve military duty.
140988 -  ..
140989 - Lynn asked what was in the letter sent yesterday?
140991 -  ..
140992 - Millie advised that the letter asks about NEUTS in the blood test this
140993 - morning. that influences decisions on approving treatment with
140994 - Carboplatin chemotherapy, and further affects requirements for
140995 - additional treatments with Neupogen, along with increasing exercise to
140996 - replenish blood supply. ref SDS D7 IJ5P
140998 -  ..
140999 - Lynn commented that looking through the medical chart she could not
141000 - find labs entered for several prior tests.  She opened Millie's
141001 - medical records on the UCSF computer and looked through prior lab
141002 - reports.  Lynn decided to invest time this morning to fill in missing
141003 - information.  This helps address issues noted by Doctor Rugo during
141004 - the meeting on 080219, so that when the doctor checks the record,
141005 - patient history is available to guide the work. ref SDS C0 L18L
141006 -
141007 -        [On 080724 Brigid cannot find CT test in the medical chart.
141008 -        ref SDS E8 TG96
141010 -  ..
141011 - Megan assisted Lynn filling in the missing data by reading from the
141012 - computer screen and correlating with cycle numbers, treatment numbers
141013 - and dates of treatments.  Missing data today may relfect that
141014 - beginning on 080313 Millie now gets blood tests every week, but only
141015 - sees the medical team every 4 weeks, as planned in the meeting on
141016 - 080306. ref SDS C2 NW9L  It was not clear today whether the medical
141017 - chart problems extended back for more than just the current cycle.
141018 -
141019 -        [On 080821 Lynn again entered data from the UCSF computer
141020 -        system reporting prior blood tests which were missing from the
141021 -        medical chart. ref SDS E9 4B6J
141023 -  ..
141024 - Megan explained there is a mistake filling out something in the
141025 - Chemotherapy Orders for starting the new cycle today.  After studying
141026 - the Chemotherapy Order for a few mintues, Lynn said something is
141027 - confusing.  Lynn asked Megan to hand write on the order "error" and
141028 - enter initials and today's date in the Chemotherpy Orders document.
141029 - There was no explanation of the error.
141031 -         ..
141032 -        [On 080605 Diane in the Infusion Clinic submitted the
141033 -        Chemotherapy Orders prepared and dated today, 080529, by Lynn
141034 -        and Megan; there is a "Received" stamp and the date 080602;
141035 -        Diane noted a handwritten comment of "error" on the entry that
141036 -        lists the amount of chemotherapy treatment, which was reduced
141037 -        from 250 mg to 175 mg, ref SDS E0 JN38; the Chemotherapy Orders
141038 -        today received on 080605 are listed in the record of treatment
141039 -        today for continuity. ref SDS D9 I66I
141041 -         ..
141042 -        [On 080625 Millie asks medical team about error in Chemotherapy
141043 -        Orders disclosed today by UCSF. ref SDS E5 PQWV
141045 -  ..
141046 - After updating the medical chart and correcting the Chemotherapy
141047 - Orders, Lynn showed results for the blood test this morning.  They
141048 - were already posted in the computer, showing timely work by the lab
141049 - this morning, aided by timely blood draws in the Infusion Clinic from
141050 - the patient arriving early, per above. ref SDS 0 4E5J
141052 -  ..
141053 - Millie's blood counts were good today NEUTS 2.26, a big jump from 0.96
141054 - last week. ref SDS D5 QY6H  This was terrific news, because low blood
141055 - counts have been problematic for this account, reported on 080501.
141056 - ref SDS D1 M653
141058 -  ..
141059 - There was consideration during the meeting that Neupogen treatment may
141060 - not be needed.  For example, change in diet this past week may have
141061 - contributed to higher counts.  Lynn commented that NEUTS 2.26 shows
141062 - favorable results from Neupogen treatment, but Millie's record of
141063 - persistant low blood counts the past 3 months without Neupogen offer
141064 - no grounds to expect blood counts can be maintained without continuing
141065 - treatment.
141067 -  ..
141068 - Lynn prescribed 1 Neupogen treatment per week for the 4th cycle, and
141069 - starting on Saturday, 080531.  Lynn explained that continuing Neupogen
141070 - will help ensure that the next treatment with Carboplatin scheduled
141071 - for next Thursday on 080605 will be given.  Prescribing 1 Neupogen
141072 - treatment today starting the 4th cycle aligns with prior work on
141073 - 080501 prescribing 1 Neupogen treatment per week for the 3rd cycle.
141074 - ref SDS D1 M658
141076 -  ..
141077 - Lynn made an examination to update findings from examination on
141078 - 050501,
141079 -
141080 -
141082 -  ..
141083 - When the meeting ended today, Lynn did not follow past practice and
141084 - submit Chemotherapy Orders, discussed and edited during the meeting,
141085 - along with blood vials for Millie to take to the Infusion Clinic on
141086 - the 5th floor.  Lynn explained the Chemotherapy Orders needs more work
141087 - to avoid confusion and ensure accuracy prescribing treatment.  Megan
141088 - will deliver the Chemotherapy Order for Carboplatin to the 5th floor
141089 - later today in time for Millie to get chemotherapy after treatment
141090 - with cetuximab which can proceed immediately.
141092 -         ..
141093 -        [...during treatment in the Infusion Clinic after meeting with
141094 -        the medical team today, Megan must have delivered the blood
141095 -        vials, because the nurse drew blood needed for the clinical
141096 -        study; the nurse further confirmed Lynn's prescription for 1
141097 -        treatment with Neupogen, and clarified that treatment should be
141098 -        on Sunday, 080601, rather than Saturday. ref SDS D9 TE6N
141100 -         ..
141101 -        [On 080605 NEUTS 1.55 barely above minimum 1.50 target range
141102 -        sufficient for safe chemotherapy treatment; nurse reports that
141103 -        Chemotherapy Orders dated 080529 and marked received by the
141104 -        Infusion Clinic on 080602 show prescription for 2 Neupogen
141105 -        treatments each week of chemotherapy on day 2 and day 3, which
141106 -        may mean Friday and Saturday, or Saturday and Sunday.
141107 -        ref SDS E0 JN3K
141109 -         ..
141110 -        [On 080605 Millie's letter to Diane in the Infusion Clinic
141111 -        asking for the Chemotherpay Orders dated today (080529), and
141112 -        showing 2 treatments per week prescribed for Neupogen, because
141113 -        Millie did not "get the word" and took only 1 Neupogen
141114 -        treatment. ref SDS E1 JO9Q
141116 -         ..
141117 -        [On 080612 NEUTS 3.77 blood counts rise significantly with 2
141118 -        Neupogen treatments, as prescribed by UCSF. ref SDS E3 PU6K
141120 -  ..
141121 - Planning to upgrade the port catheter to a Power Port reported by
141122 - Kaiser on 080523, ref SDS D6 MG6F, was not discussed during the
141123 - meeting today, because Lynn did not get the letter on this issue
141124 - submitted to UCSF yesterday, ref SDS D7 IJ6W, as related above.
141125 - ref SDS 0 4E69
141127 -  ..
141128 - Lynn asked Millie if she received a printed report from the staff at
141129 - the front desk showing her current medications, based on the meeting
141130 - last month when Brigid discussed this with Millie, reported 080501?
141131 - ref SDS D1 QK4G
141133 -  ..
141134 - Millie reported she did not receive a list of current medications at
141135 - the front desk this morning.
141137 -  ..
141138 - Lynn apologized for this mistake, saying things have been hectec,
141139 - which slows and disrupts case management.
141141 -  ..
141142 - Lynn seemed to indicate UCSF wants patients to examin the printed
141143 - list, enter changes based assumptions from remembering all of the
141144 - prescriptions, and then sign the report for UCSF records.  This aligns
141145 - with understandings from the meeting with Brigid on 080501.
141146 - ref SDS D1 9F5O
141147 -
141148 -        [On 080502 Millie received a list of Current Medications
141149 -        maintained on Kaiser's computer. ref SDS D2 IE6M
141151 -  ..
141152 - Megan discussed scheduling the next CT test.  She asked when the last
141153 - test was performed and how many weeks are planned between tests?
141154 -
141155 -        [On 080605 Millie's letter to UCSF confirms understandings
141156 -        today that Kaiser plans surgery to implant Power Port in time
141157 -        for next CT test in mid-July. ref SDS E1 634V
141159 -  ..
141160 - Patient history shows the last test was on 080425, ref SDS C8 9W9I,
141161 - which was 12 weeks after the previous test on 080212. ref SDS B8 FP5H
141162 - The report for the test on 080425 was reviewed on 080428. ref SDS C9
141163 - 6V5I  On 071007, UCSF was asked to change CT test frequency from 8 to
141164 - 12 weeks in order to save money and reduce injury from needle
141165 - punctures injecting contrast medium. ref SDS B2 465H  Since CT tests
141166 - for several years showed no progression of disease, ref SDS B2 S68Q,
141167 - on 071009 the doctor got permission from clinical study management to
141168 - extend testing from 8 to 12 week intervals. ref SDS B3 985H
141170 -  ..
141171 - On 080207 UCSF ordered expedited CT testing to assess rising
141172 - adenopathy reported in the test on 071210. ref SDS B7 GH5M  As a
141173 - result the CT test was done a few days later on 080212. ref SDS B8
141174 - FP5H  This test was reviewed on 080215 and indicated rising adenopathy
141175 - in the right axilla. ref SDS B9 J85H  On 080219 the doctor cited the
141176 - test on 080212 to determine progerssion of disease that requires
141177 - increased treatment, moving Millie to the 2nd arm of the clinical
141178 - trial study by adding Carboplatin to cetuximab treatments for her IBC
141179 - disease.
141181 -  ..
141182 - Millie asked during the meeting today about doing the next CT test on
141183 - the 8 week schedule based on concerns from the test on 080212?  The
141184 - next CT test was on 080425, ref SDS C8 L86Y, 12 weeks after the test
141185 - on 080212, and assessed results from increasing treatment, begun on
141186 - 080313.
141188 -  ..
141189 - Since the last test was on 080425, an 8-week test schedule requires
141190 - the next CT test on 080620, about 3 weeks from today.  Testing on or
141191 - about 080620 would provide time for Kaiser to write and distribute the
141192 - test report, and for the medical team to review the report in order to
141193 - prepare for the meeting to start the next cycle on 080626.
141195 -  ..
141196 - The 12-week schedule puts the next CT test on or about 080718, which
141197 - allows time to prepare for the meeting to start the next cycle on
141198 - 080724.
141200 -  ..
141201 - The primary care physician at Kaiser has been coordinating with the
141202 - surgeon to plan a meeting for scheduling work to upgrade the port
141203 - catheter to a Power Port.  This was discussed with Brigid 4 weeks ago
141204 - at UCSF on 080501. ref SDS D1 766K  The next day work began to
141205 - coordiante with the surgery department to perform the work.
141206 - ref SDS D2 VG5J   Kaiser has not had time to schedule the work.  If
141207 - the next CT test is just 3 weeks away, this may present a scheduling
141208 - challenge for Kaiser and the surgeon.  Doing the next test on the
141209 - 12-week schedule affords more time for completing work on the Power
141210 - Port.
141211 -
141212 -        [On 080605 Millie's letter to UCSF confirms understandings
141213 -        today that Kaiser plans surgery to implant Power Port in time
141214 -        for next CT test in mid-July. ref SDS E1 634V
141216 -         ..
141217 -        [On 080606 meeting at Kaiser to schedule surgery upgrading
141218 -        port catheter to Power Port in time for next CT test OA 080718.
141219 -        ref SDS E2 IT8V
141221 -         ..
141222 -        [On 080617 Power Port surgery scheduled on 080708.
141223 -        ref SDS E4 3C7N; CT test using Power Port scheduled 10 days
141224 -        later on 080718 1100. ref SDS E4 DF55
141226 -         ..
141227 -        [On 080708 Millie gets surgery for Power Port. ref SDS E7 IT77
141229 -  ..
141230 - We wanted to discuss Millie's occassional spike in pulse, reported in
141231 - the record on 080507, ref SDS D3 PQ5L, and in relation to CT test
141232 - reports of heart issues. ref SDS D3 CK4K  This was not discussed,
141233 - because nobody could remember the issue, after helping Lynn get up to
141234 - speed on Millie's patient history.
141236 -  ..
141237 - Lynn noted there is no evidence of Cellulitis on Millie's left arm,
141238 - which correlates with Millie completing the 10-day treatment with
141239 - Keflex prescribed by Kaiser on 080520. ref SDS D4 1K7H  This verifies
141240 - Millie's report to the medical team yesterday on 080528 about good
141241 - progress recovering from Cellulitis. ref SDS D7 IJ5V
141242 -
141243 -        [On 080627 primary care physician examination at Kaiser finds
141244 -        no evidence of Cellulitis nor lymphedema. ref SDS E6 PU6J
141245 -
141246 -
141247 -
141248 -
1413 -

SUBJECTS
UCSF Security Services Investigate HIPAA Complaint Patient Privacy B

4003 -
4004 - 1240
400501 -  ..
400502 - Security Services Disrupt Work Cafeteria Seating Dispute
400503 - Work Disrupted Cafeteria Seating Dispute UCSF Security Services
400504 - Cafeteria Seating Dispute UCSF Security Services Disrupts Work
400505 - Confidentiality UCSF Security Svcs Investigate Working Efficiently
400506 -
400507 - After taking Millie her lunch, on returning to the cafeteria, Peter
400508 - Balesteri was discovered walking up the stairs carrying c15 in some
400509 - disarray.
400511 -  ..
400512 - Peter was asked to explain this taking of customer property?
400514 -  ..
400515 - Peter identified himself as Director of the UCSF Medical Center
400516 - Security department.
400518 -  ..
400519 - Peter related that the Security department received a call reporting
400520 - an unattended computer and medical documents in the cafeteria.  Peter
400521 - seemed to indicate the complaint was filed by a doctor, administrator,
400522 - or manager who was worried about UCSF employees making unauthorized
400523 - disclosure of patient data.  This part of the report was unclear, as
400524 - to whether a cafeteria patron reported another customer suspiciously
400525 - viewing computer data and documents which belonged to someone else.
400526 - Peter came to the cafeteria to investigate, and arrived in time to
400527 - prevent theft of the computer and documents.
400529 -  ..
400530 - Peter said UCSF procedures require security officers to write up an
400531 - "incident" report.
400533 -  ..
400534 - Peter advised that he did not inquire from the person who called why
400535 - someone would be examining a computer screen that was turned in a way
400536 - which requires walking behind a table positioned in the corner of the
400537 - room so that only someone using the computer can see the screen?  This
400538 - would be extremely suspicious conduct that would justify cafeteria
400539 - patrons reporting potential theivery.
400541 -  ..
400542 - Since the computer is configured with security to go blank within a
400543 - few minutes of non-use.  How would anyone see anything on the computer
400544 - screen?   Did someone press a key on a computer that did not belong to
400545 - them?  This would be extremely suspicious conduct?  What did the UCSF
400546 - Security Services investigation learn about who did this, and what was
400547 - discovered by illegal conduct?
400549 -  ..
400550 - Peter claimed to have waited 10 minutes in the cafeteria for someone
400551 - to return and resume work with the computer.  Durng this time he
400552 - examined the computer and observed confidential patient health care
400553 - data.  There was no explanation of how information on the computer
400554 - screen can be seen when the screen goes blank and requires a
400555 - confidential password to access the display?   The logon security
400556 - splash screen also displays the name of the person authorized to use
400557 - the computer.
400559 -  ..
400560 - Peter did not cite any authority for UCSF Medical Center Security
400561 - forces to examine confidential patient health care data, nor any data
400562 - belonging to UCSF patients.  What procedures guide security personnel
400563 - conduct to protect privacy of UCSF customers?
400565 -  ..
400566 - Peter did not explain who in the cafeteria was questioned during his
400567 - 10 minute investigation about suspecious conduct of someone stepping
400568 - behind the table to view a computer screen and rifle through documents
400569 - which everyone knew was wrong, because everyone has seen the same
400570 - person at the same computer in the exactly the same spot every
400571 - Thursday for the past 18 months.
400573 -  ..
400574 - The time line in this case seems conflicting.
400576 -  ..
400577 - The computer was unattended for only about 10 minutes, while lunch was
400578 - delivered to Millie on the 5th floor.  Actually, it took about 5
400579 - minutes to go into the cafeteria and get the soup, because at 1220
400580 - (Millie had asked for lunch at 1230), Jo Ann happened to be in the
400581 - cafeteria, and helping herself to the minestroni soup, which Millie
400582 - had asked for her lunch.  Millie knows her from the Wellness Community
400583 - cancer support group.  She has difficulty with her leg in addition to
400584 - having cancer, and needed a ride today, so we met her at the Walnut
400585 - Creek BART station at 0530.  Helped her with her walker, and so on.
400586 - She just happened to be in the cafeteria at the same time Millie
400587 - wanted lunch.
400589 -  ..
400590 - After getting soup and crackers, and standing in line to pay, the
400591 - computer was checked in the lunch room, and everything was okay, so
400592 - this might have about 1225.
400594 -  ..
400595 - Lunch was then delivered and this took about 10 minutess, the same
400596 - time Peter recalled was required for his investigation.
400598 -  ..
400599 - Someone must have subsequently seen the computer on a table, and then
400600 - somehow examined data on a blank computer screen which was known or
400601 - reasonably should have been know to belong to someone else.  This
400602 - person would then have had to make a telephone call.  As things go
400603 - these days, it is rare to get through to anyone.  Typically people
400604 - have to punch various buttons, are on hold, asked to leave a message.
400605 - Doctors have a lot of difficulty coordinating work by telephone to
400606 - care for patients, reported on 080403. ref SDS C4 IM87  It strains
400607 - credulity to believe that calling about patient privacy gets higher
400608 - priorty than caring for the patient.
400610 -  ..
400611 - After the 10 minute investigation, Peter decided to take c15 together
400612 - with the keyboard and all customer documents to his office, despite
400613 - the fact that the customer's partially eaten lunch and coat draped
400614 - over a chair, was in plain sight indicating intent to return
400615 - momentarily.
400617 -  ..
400618 - Peter explained he took immediate action to confiscate cafeteria
400619 - customer property for two reasons...
400620 -
400621 -        1.  The San Francisco Chronicle published an article in the
400622 -            paper today about confidentiality of patient medical
400623 -            records.
400625 -  ..
400626 - Peter explained that UCSF policy for confidentiality of patient
400627 - medical records prevents patients from disclosing their own medical
400628 - records based on personnel assessment of risks and opportunities,
400629 - discussed further below. ref SDS 0 C38H
400631 -             ..
400632 -        2.  Peter believes HIPAA regulations justify UCSF Medical
400633 -            Center Security forces to confiscate unattended computers
400634 -            and documents with medical information.
400636 -  ..
400637 - After this incident, a search could not find any articles in the San
400638 - Francisco Chronicle today dealing with HIPAA, health care, medical
400639 - records privacy, or anything remotely related to such issues.
400640 -
400641 -               [On 090219 1315 HIPPA cited for preventing submission of
400642 -               patient medical records to the patient. ref SDS F0 9O6L
400643 -
400644 -
4007 -

SUBJECTS
UCSF Fund Raising HIPAA Violations 6300 Patient Privacy Violations C

7303 -
730401 -  ..
730402 - UCSF Medical Center Security Department should submit the article
730403 - Peter believes justifies seizing UCSF customer property to complete
730404 - the record in this case showing there was no abuse of authority.
730405 -
730406 -               [On 090219 1315 HIPPA cited for preventing submission of
730407 -               patient medical records to the patient. ref SDS F0 9O6L
730409 -  ..
730410 - The only recent article found in the Chronicle was about a month ago,
730411 - and pertained to massive and pervasive failure to perform duites which
730412 - UCSF owes to protect patient privacy and confidentiality of medical
730413 - records...
730415 -             ..
730416 -            UCSF Fund Raising HIPAA Violations Medical Identify Online
730417 -            Medical Identify Theft UCSF Fund Raising HIPAA Violations
730418 -
730419 -
730420 -            6,000 UCSF patients' data got put online
730421 -            Elizabeth Fernandez, Chronicle Staff Writer
730422 -            May 2, 2008
730423 -
730424 -              http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/05/02/MNKE10DRGN.DTL
730426 -             ..
730427 -            (05-01) 17:22 PDT San Francisco -- Information on thousands
730428 -            of UCSF patients was accessible on the Internet for more
730429 -            than three months last year, a possible violation of
730430 -            federal privacy regulations that might have exposed the
730431 -            patients to medical identity theft, The Chronicle has
730432 -            learned.
730434 -             ..
730435 -            The information accessible online included names and
730436 -            addresses of patients along with names of the departments
730437 -            where medical care was provided.  Some patient medical
730438 -            record numbers and the names of the patients' physicians
730439 -            also were available online.
730441 -             ..
730442 -            The breach was discovered Oct. 9, but the medical
730443 -            institution did not send out notification letters to the
730444 -            6,313 affected patients until early April, nearly six
730445 -            months later.
730447 -             ..
730448 -            The consequences of health care data breaches can be
730449 -            significant, said experts.  Sensitive information can be
730450 -            used by employers, health insurers and other entities to
730451 -            discriminate.  Additionally, thieves can use purloined
730452 -            information to obtain medical treatment and prescription
730453 -            drugs and to file false medical claims.
730454 -
730455 -            ...
730457 -             ..
730458 -            The breach spotlights a little-known practice among
730459 -            medical institutions to plow the ranks of patients for
730460 -            fund raising purposes.
730462 -             ..
730463 -            Hospitals and other health care providers are turning
730464 -            patients into "fundraising free-fire zones," said Dr.
730465 -            Arthur Caplan, chairman of the department of medical
730466 -            ethics at the University of Pennsylvania School of
730467 -            Medicine.
730468 -
730469 -            "The breach is a symptom, but the real ethics challenge is
730470 -            the extent to which health care institutions are tracking
730471 -            patients and their families for nonmedical reasons - for
730472 -            fundraising, marketing, advertising," Caplan said. "I
730473 -            don't think people are aware of the degree to which this
730474 -            is occurring, whether it's by a hospital or a nursing home
730475 -            or a hospice."
730477 -             ..
730478 -            In January, California began requiring health care
730479 -            providers to alert consumers if their medical information
730480 -            is breached. Swift notification is considered important so
730481 -            consumers can monitor credit reports and bills.
730483 -             ..
730484 -            According to Joanne McNabb, chief of the California Office
730485 -            of Privacy Protection, notice should be given "in the most
730486 -            expedient time possible, without unreasonable delay."
730487 -
730488 -            "It's a judgment call, the how and the when part," McNabb
730489 -            said. "The idea is to give early warning so that people
730490 -            can take defensive action. On the other hand, you don't
730491 -            want to needlessly worry people."
730493 -             ..
730494 -            A federal privacy regulation known as HIPAA, the Health
730495 -            Insurance Portability and Accountability Act, sets
730496 -            standards to protect personal health information. Health
730497 -            care entities are allowed, for fundraising activities, to
730498 -            release to business associates - without explicit
730499 -            individual authorization - certain demographic
730500 -            information, such as names, addresses and dates of
730501 -            treatment, but not information about health or health
730502 -            care.
730503 -
730504 -            "You cannot provide other information for fundraising
730505 -            purposes," said a senior official with the U.S. Department
730506 -            of Health and Human Services' Office for Civil Rights.
730507 -
730508 -
730509 -
730510 -
7306 -

SUBJECTS
Context Unattended 10 Minutes Minor Medical Records Schedule Meeting

A603 -
A60401 -  ..
A60402 - Context Unattended Computer Presented Minimal Risk Patient Privacy
A60403 - Patient Assistant Role Doctor Patient Partnership Knowledge Management
A60404 - Knowledge Management Capturing Record New Way Working Not Familiar
A60405 -
A60406 - Peter asked for identification.  This was provided showing the name
A60407 - and photograph on the driver's license was the same as the name shown
A60408 - on the login screen of the computer.
A60410 -  ..
A60411 - Peter seemed concerned that the computer and documents were left
A60412 - unattended by a UCSF employee.
A60414 -  ..
A60415 - Examining customer identification, Peter found no association with
A60416 - UCSF; and, he learned the work being performed with the computer and
A60417 - documents was assisting a UCSF patient perform case management to
A60418 - optimize health care.
A60420 -  ..
A60421 - Peter was unaware of the patient's name.  This fact established there
A60422 - was no breach of patient identification, and Peter's report of 10
A60423 - minute exposure, ref SDS 0 L252, shows patient privacy in this case
A60424 - was at all times far more secure than UCSF permitted of 3 months
A60425 - exposure in the case reported by the Chronicle on 080502, per above.
A60426 - ref SDS 0 LN7G
A60427 -
A60428 -        [On 080605 Millie's letter advises that leaving the patient
A60429 -        assistant computer unattended for a few minutes to deliver
A60430 -        lunch to a cancer patient getting treatment was not a breach of
A60431 -        patient privacy by UCSF, as occurred recently, reported by the
A60432 -        Chronical on 080502. ref SDS E1 633Q
A60434 -  ..
A60435 - Peter asked why a "patient assistant" would leave a computer
A60436 - unattended for 10 minutes in the cafeteria?
A60438 -  ..
A60439 - Millie needed lunch, and follow up on status of treatment in order to
A60440 - plan for going home.  Does she need anything, juice, some crackers?
A60441 - Has anything occurred, e.g., treatments, communications, that needs
A60442 - review to support the doctor patient partnership for case management?
A60444 -  ..
A60445 - The computer is very heavy.  It takes several minutes to assemble the
A60446 - computer, and all of the documents spread out for work, and additional
A60447 - time to re-configure everything in order to resume work.  Leaving the
A60448 - computer unattended for a few minutes makes delivering lunch, going to
A60449 - the restroom, going next door to the cafeteria for something to eat or
A60450 - drink, a lot faster and easier than spending 10 minutes assembling,
A60451 - carrying, and re-configuring the work setup for each episode of
A60452 - momentary movement.  Leaving the computer unattended with partially
A60453 - eaten meal signals to other customers that the space is taken.
A60455 -  ..
A60456 - Accordingly, during this 10 minute period, lunch was delivered to
A60457 - Millie getting treatment on the 5th floor.  This has been done
A60458 - approximately 70 times over the past 15 months without incident.
A60460 -  ..
A60461 - Peter refused to return the computer.  He was beginning to perspire
A60462 - from standing in the middle of the cafeteria stairway, as customers
A60463 - streamed by, holding all the equipment that weighs 20 - 30 pounds in
A60464 - an awkward position with everything in disarray.  He seemed hurried
A60465 - from having scooped up equipment, documents, carrying case, and
A60466 - cables, rather than invest another minute to arrange things in a
A60467 - standard configuration with the computer, cables, and documents inside
A60468 - the carrying case.
A60470 -  ..
A60471 - Peter said he was not familiar with the patient assistant role.  He
A60472 - remained suspicious that a UCSF doctor or staff member had violated
A60473 - Medical Center policy on computer and document security.
A60475 -  ..
A60476 - Peter insisted that HIPAA required confiscating or impounding customer
A60477 - property.  Peter further related that taking customer property is
A60478 - justified to avoid claims against UCSF in the event someone steals
A60479 - unattended property.
A60481 -  ..
A60482 - Peter proposed taking the computer to his office for further
A60483 - investigation.
A60485 -  ..
A60486 - While traveling up the elevator, he changed his mind or possibly
A60487 - forgot to press the right button on the elevator, because we
A60488 - eventually wound up back on the first floor.
A60490 -  ..
A60491 - Peter then proposed a joint meeting with Millie's doctor to verify the
A60492 - patient assistant role.  We went to the 2nd floor Breast Care Clinic.
A60493 - Upon learning that the doctor is out of town today attending a
A60494 - conference, Peter suggested visiting Millie in the Infusion Clinic to
A60495 - verify the patient assistant role.  Peter was adament retaining
A60496 - custody of customer property, which he continued to carry in disarray.
A60498 -  ..
A60499 - On arriving at the 5th floor Infusion Clinic, Peter realized that
A60500 - visiting a cancer patient to ask for bonifides of a patient assistant
A60501 - can cause emotional stress and anxiety that compounds health maladies.
A60502 - Millie's treatment for anxiety on 080305 supports Peter's analysis and
A60503 - conclusion to avoid patient stress. ref SDS C1 KT4J  As a result,
A60504 - Peter decided to go back to the 2nd floor and meet with the Practice
A60505 - Manager to discuss disposition in this matter.
A60507 -  ..
A60508 - We then took the elevator back to the 2nd floor, without ever getting
A60509 - off at the 5th floor.
A60510 -
A60511 -
A60512 -
A606 -

SUBJECTS
UCSF Invest Hours Investigate Patient Privacy Medical Records Disrup

B003 -
B00401 -  ..
B00402 - Meeting Practice Manager Breast Care Clinic Review Patient Privacy
B00403 -
B00404 - At the Breast Care Clinic on the 2nd floor, Peter asked for the
B00405 - practice manager.  He was able to relieve stress and strain by resting
B00406 - the computer, the keyboard, the carrying case and all the documents on
B00407 - the customer counter in the lobby.  He was told the Practice Manager
B00408 - person was in a meeting, but would try to pull away in order to meet
B00409 - with Medical Center Security forces.
B00411 -  ..
B00412 - Peter decided at this time it was safe to return impounded property to
B00413 - the customer.  While waiting for the Practice Manager to arrive, the
B00414 - computer, cables, surge protector, and documents were arranged
B00415 - properly in the carrying case for safe and secure handling.
B00417 -  ..
B00418 - About 10 minutes later, Sara Schwab introduced herself as the Practice
B00419 - Manager for the Breast Care Clinic.  Peter asked to meet in a
B00420 - confidential room on a matter of privacy and confidentiality for
B00421 - patient medical records.
B00423 -  ..
B00424 - Sara led the way through various hallways to her office, which was
B00425 - behind several locked doors.  The door to her office was also locked.
B00426 - She used a key which was secured with a coil wrapped around her wrist
B00427 - to open the door to her office.
B00429 -  ..
B00430 - Getting into Sara's office through 2 or 3 locked doors accessible only
B00431 - to UCSF staff, colleagues, subordinates, and supervisors demonstrates
B00432 - high priority UCSF gives to patient confidentiality, consistent with
B00433 - public reporting on disclosure of 6,000 patient identies by a UCSF
B00434 - contractor, reported on 080502, per above. ref SDS 0 526J
B00436 -  ..
B00437 - Peter related his investigation and findings to Sara, who took notes
B00438 - during Peter's presentation.
B00439 -
B00441 -  ..
B00442 - Schedule Meeting with Doctor Example Patient Alleged Violation HIPAA
B00443 -
B00444 - Peter gave an example that he saw a schedule for Millie to meet with
B00445 - the doctor and get treatments over the next few months.  He indicated
B00446 - this somehow created a HIPAA violation which would risk the hospital's
B00447 - standing as a top cancer center.
B00448 -
B00449 -        [On 080605 Millie's letter to UCSF, including Security Services
B00450 -        Department, advised that disclosing patient schedule meeting
B00451 -        with the doctor is commonly conveyed to others; seeing the
B00452 -        schedule printed on paper is not an objectionable compromise of
B00453 -        medical privacy. ref SDS E1 625Y
B00454 -
B00455 -
B00456 -
B005 -

SUBJECTS
HIPAA Protects Patient Privacy Disclosure Patient Consent Confidenti

C203 -
C20401 -  ..
C20402 - HIPAA Protects Patient Privacy from Disclosure by Hospital Doctor
C20403 - Patient Lawfully Empowered Discretion Disclose Medical Records to Anyone
C20404 -
C20405 - Peter and Sara were advised that Millie appreciates extra time UCSF
C20406 - invests giving priority to protect patient privacy.
C20408 -         ..
C20409 -        [On 080605 Millie's letter advises that UCSF has at all times
C20410 -        maintained patient privacy. ref SDS E1 633Q
C20412 -  ..
C20413 - HIPAA was reviewed on 071009 when UCSF asked Kaiser to threaten the
C20414 - patient with legal reprisals under color of HIPAA, ref SDS B4 JW7M, in
C20415 - order to force payment by the patient to UCSF, ref SDS B4 JW59, which
C20416 - was owed by Kaiser, and was subsequently paid by Kaiser, reported on
C20417 - 071128. ref SDS B5 JZ64  Millie is aware that Kaiser and UCSF
C20418 - management do not condone nor encourage missuse of HIPAA or other
C20419 - regulations.  Accordingly, citing HIPAA does not justify confiscating
C20420 - customer property.
C20421 -
C20422 -               [On 090219 1315 HIPPA cited for preventing submission of
C20423 -               patient medical records to the patient. ref SDS F0 9O6L
C20425 -  ..
C20426 - HIPAA vests patients with rights of privacy and confidentiality which
C20427 - health care providers, like doctors, nurses, hosptials, etc., have a
C20428 - duty to honor.  Medical practice requires balancing privacy rights
C20429 - against other rights, including the right to timely, effective care.
C20430 - Patients have the right to voluntarily give up some portion of privacy
C20431 - in order to advance their care.  Health care Providers are required to
C20432 - honor patient rights to exercise discretion giving up some
C20433 - confidentiality in order to secure better care.
C20435 -  ..
C20436 - In this case, UCSF has at all times met its responsibilities to the
C20437 - patient by obtaining written consent to distribute patient health care
C20438 - data to clinical study personnel, reported on 070119, ref SDS 58 1G3K,
C20439 - and supplemental authorization for distribution of biopsy tissue on
C20440 - 070130. ref SDS 60 2O3L  In return for giving up some privacy, the
C20441 - patient benefits from better care.
C20442 -
C20443 -        [On 080605 Millie's letter advises that UCSF has at all times
C20444 -        maintained patient privacy. ref SDS E1 633Q
C20446 -  ..
C20447 - Similarly, the patient can exercise discretion telling someone on the
C20448 - bus, at a party, on an airplane, or on national television that they
C20449 - have just come from a meeting with the doctor at UCSF, and get
C20450 - treatment every week at such and such a time.  Patient's can tell
C20451 - others that their treatment has been terrific, and they wish everyone
C20452 - could benefit from UCSF's excellent work.  Patient disclosure cannot
C20453 - violate patient rights of confidentiality under HIPAA because the
C20454 - patient has the right to exercise discretion.  UCSF requires patient
C20455 - consent to disclose patient information, which evidently was violated
C20456 - noted in the Chronical article cited by Peter today, per above,
C20457 - ref SDS 0 526J, but the patient may disclose at will to aid their
C20458 - health care, and is not burdened by constraints that prevent a health
C20459 - care provider from using patient medical records for fund raising, as
C20460 - UCSF did, per above. ref SDS 0 LN52
C20462 -  ..
C20463 - Examples abound of patients exercising discretion to disclose personal
C20464 - medical history on the Internet, for example an article published in
C20465 - the March/April 2008 issue of Maim...
C20466 -
C20467 -            Women Cancer and Community
C20468 -            Blogging Breast Cancer
C20470 -  ..
C20471 - The article reports...
C20472 -
C20473 -      Thousands of women are sharing their souls to the world - without
C20474 -      every leaving their computers.  Why are online diaries so
C20475 -      popular?
C20476 -
C20477 -      July 30, 2005: ...I have been from the very beginning completely
C20478 -      sold on the idea that I am going to beat cancer.  I don't know
C20479 -      when it's going to happen, I don't know how it's going to happen.
C20480 -      I just know it....  I know [the hospital social worker is] trying
C20481 -      to prepare  me for what, statistically, is my probable outcome.
C20482 -      But, she doesn't know me.  I AM NOT A STATISTIC!
C20484 -       ..
C20485 -      A growing part of this dynamic "blogosphere" are diaries created
C20486 -      by women with breast cancer who share their highly personal
C20487 -      journeys-from first diagnosis through treatment, from fears of
C20488 -      death to exuberance after a cancer-free checkup.  Karen George,
C20489 -      who wrote the entries on the previous page, is one of them.  Only
C20490 -      30 when she was diagnosed with stage iv breast cancer, she never
C20491 -      intended to share her experience with anyone outside her family.
C20493 -  ..
C20494 - Patients are entitled to disclose whatever they wish about their
C20495 - health records.  Hospitals and health care providers are required to
C20496 - protect confidentiality of patient records, especially avoiding
C20497 - attempts to sell patient records for fund raising reported in the San
C20498 - Francisco Chronicle article, which Peter cited, per above. ref SDS 0
C20499 - LN7G
C20501 -  ..
C20502 - Discussed flexibility in this matter?
C20504 -  ..
C20505 - Leaving documents with patient data on display and unattended, though
C20506 - not unlawful for the patient, may well cause anxiety and frustration
C20507 - to UCSF employees having lunch in the cafeteria, because they are
C20508 - forced by HIPAA to take stringent precautions that protect patient
C20509 - privacy, shown by the visit with Sara today, who has everything under
C20510 - lock and key, per above. ref SDS 0 H64L
C20512 -  ..
C20513 - Since we have gotten through for 18 months without incident, can this
C20514 - issue be addressed by closing the computer case, so that documents are
C20515 - not readily visible, when of necessity the computer is unattended for
C20516 - a few seconds or minutes?
C20518 -  ..
C20519 - Would patient property be adequately "attended" if a neighbor at an
C20520 - adjacent table watched the computer, while the customer ran to the
C20521 - cafeteria for a glass of water, say 2 minutes, or to the restroom down
C20522 - the hall for 5 minutes, or take Millie her lunch for 10 minutes?
C20524 -  ..
C20525 - What seems to have occurred in this case is that a cafeteria customer
C20526 - got angry because all the tables were taken, or a favorite table was
C20527 - taken, and so filed a complaint to get a place to have lunch.
C20528 - Alternativley, a manager may have walked through the cafeteria and was
C20529 - genuinely worried that a doctor or other UCSF employee had breeched
C20530 - patient confidentiality by leaving data exposed.
C20531 -
C20532 -        [On 080605 another UCSF security officer disclosed that UCSF
C20533 -        security forces have been investigating Rod for several months
C20534 -        due to complaints by cafeteria customers about someone using a
C20535 -        computer during lunch time. ref SDS E0 0N44
C20537 -  ..
C20538 - How can UCSF Security procedures be accomplished with respect and good
C20539 - faith, and also meet exigencies of patient care?   If there is an
C20540 - empty office somewhere outside the cafeteria, this might help relieve
C20541 - tensions.
C20543 -  ..
C20544 - Additionally, there can be safety in numbers.
C20546 -  ..
C20547 - Most theives are risk averse.  Stealing a computer and documents that
C20548 - seem unattended in a crowded room presents risk of being reported, as
C20549 - occurred today, and of discovery, as Peter was discovered today
C20550 - walking away with customer property, per above. ref SDS 0 LD7L  How
C20551 - does a theif know if the user is just chatting with people at the
C20552 - adjacent table, or is returning by the planned escape route, again as
C20553 - occurred here?  This does not diminish UCSF concerns, nor tarnish
C20554 - timely work by the Security department today, but recognizes balancing
C20555 - forces are at play that justify taking risks diminished by context in
C20556 - order to accomplish effective patient care.
C20557 -
C20558 -
C20559 -
C206 -

SUBJECTS
Patient Interviewed UCSF Security Services Verify Patient Assistant

CO03 -
CO0401 -  ..
CO0402 - UCSF Decides to Verify Patient Assistance Role Manage Medical History
CO0403 -
CO0404 - Peter discussed with Sara warning the patient that the assistant was
CO0405 - not using good judgement leaving a computer and documents with health
CO0406 - care information unattended in the cafeteria.  Regardless of HIPAA,
CO0407 - this seemed reckless and irresponsible.  Peter mentioned the article
CO0408 - in the San Francisco Chronicle again, per above, ref SDS 0 H46K, that
CO0409 - has everyone at UCSF on pins and needles being extra careful today
CO0410 - about patient health care records.  Was unclear if Sara had seen the
CO0411 - article.  She recognized Peter's concern.
CO0413 -  ..
CO0414 - Suggested that Sara or Peter send an email to Millie's nurse in the
CO0415 - Infusion Clinic.  Alternatively, calling the nurse to convey a message
CO0416 - would avoid disrupting patients in a sensitive, weakened emotional
CO0417 - state that occurs with chemotherapy treatment.
CO0419 -  ..
CO0420 - Sara seemed to agree that Peter should go to the 5th floor Infusion
CO0421 - Clinic and meet with the patient outside the presence of the patient
CO0422 - assistant, to verify the story, and emphasize the importance of
CO0423 - privacy to the patient.
CO0424 -
CO0426 -  ..
CO0427 - Patient Interviewed During Treatment About HIPAA Violations
CO0428 -
CO0429 - After meeting with Sara, Peter went to the 5th floor and interviewed
CO0430 - Millie.  Peter asked the patient assistant to wait in the lobby rather
CO0431 - than provide assistance to the patient, similar to UCSF's work on
CO0432 - 071009, when Kaiser invoked HIPAA to warn the patient to pay money to
CO0433 - UCSF that was owed by Kaiser, cited above. ref SDS 0 H67I
CO0435 -  ..
CO0436 - Peter or the nurse pulled the privacy screen closed around Millie's
CO0437 - chair.  Since this is the first time in 18 months this precaution has
CO0438 - been taken, and since Peter is with the Medical Center Security
CO0439 - department, Millie recognized the meeting was important.
CO0441 -  ..
CO0442 - Peter related the story and efforts by UCSF Medical Center Security
CO0443 - forces to protect Millie's privacy in this case.  Millie was impressed
CO0444 - with Peter's courtesy, care, and professionalism explaining sensitive
CO0445 - patient privacy issues.
CO0446 -
CO0447 -        [On 080605 Millie's letter to UCSF commends Peter and Sara for
CO0448 -        timely, effective security support. ref SDS E1 625Q
CO0450 -  ..
CO0451 - Peter returned from the meeting, and released the patient assistant
CO0452 - for duty.
CO0454 -  ..
CO0455 - Back in the cafeteria, this episode removed about 90 minutes from
CO0456 - doctor patient partnership support for case management.  Someone was
CO0457 - using the table.  Partially eaten lunch was still at the table.  This
CO0458 - was taken to the trash, and another table was used until Millie came
CO0459 - down after her treatment was completed.
CO0461 -  ..
CO0462 - Besides 90 minutes working with Medical Center Security staff, another
CO0463 - 60 minutes or so was required to write up the record in order to
CO0464 - guide work going forward.
CO0465 -
CO0466 -
CO0467 -
CO0468 -
CO0469 -
CO0470 -
CO0471 -
CO0472 -
CO05 -