Statement issued by UCLA Health System, April 6:
UCLA Health System considers patient confidentiality a critical part of our mission of providing the highest level of teaching, research and patient care. Our concern for our patients is absolute, and we regret any breach of patient confidentiality.
After news stories first appeared in May 2007 about an unauthorized release of patient information, we conducted a full investigation and determined that a single worker, who is no longer employed, was responsible for that incident, as well as the unauthorized viewings of multiple patient records. Consistent with state law and based on the findings of our investigation, we did not notify the Department of Public Health or the affected patients at that time.
Like other medical institutions in California and across the country, UCLA Health System is engaged in a continuing effort to strengthen its information technology infrastructure to protect against the potential of patient information breaches. We continue to take steps to improve security systems designed to preclude access by unauthorized individuals, while also ensuring that properly assigned medical personnel can quickly retrieve the information required for emergency or other treatment decisions to best meet the needs of its patients.
Importantly, UCLA Health System has stringent policies familiar to all employees to protect patient confidentiality. All staff and faculty members, contractors, volunteers and other workers are required to sign confidentiality agreements as a condition of their employment and they complete extensive training on federal Health Insurance Portability and Accountability Act-related privacy and security issues.
As the result of our ongoing efforts, an audit in February resulted in the termination and suspension of several employees in connection with unauthorized viewing of a patient’s record.
Comment: Although state law and HIPAA may not have required notification to the Dept. of Health or affected patients, UCLA always had the option to notify and clearly chose not to. I believe that greater transparency and disclosure ultimately promote greater trust and confidence and would encourage entities to notify and disclose. I would also encourage states and Congress not to give entities the option of notifying and to make it mandatory.