San Franciso General Hospital and Trauma Center

A physician formerly affiliated with a business associate, the University of California, San Francisco (UCSF) removed patients’ electronic protected health information (ePHI) from the covered entity (CE), San Francisco General Hospital and Trauma Center , without authorization. The CE estimated that approximately 2,500 individuals were affected by the breach. The types of ePHI affected included patients’ names, surgical notes, consultation notes, and radiologic films. The CE provided breach notification to affected individuals, the media, and HHS. In response the breach, the CE implemented new HIPAA Privacy and Security policies and procedures, including a new/updated Security Rule Risk Management Plan and Security Risk Analysis, new technological safeguards, periodic technical and non-technical evaluations, and trained and retained workforce members . OCR obtained assurances that the CE implemented the corrective actions noted above.