Main content

    Audit finds employee access to patient files without apparent business or treatment purpose

    News Release
    Contact: Dean Fryer -- 415-600-7484 or pager 415-232-6463

    San Francisco, CA, January 23, 2015 ——California Pacific Medical Center (CPMC) recently notified 844 patients of its discovery that a pharmacist employee may have accessed their records without a business or treatment purpose.

    CPMC first learned of the incident through a proactive audit of its electronic medical record system on October 10, 2014. The initial audit resulted in identification and notification of 14 individuals on October 21, 2014. Following its policy, CPMC terminated its relationship with the employee and broadened the investigation

    The expanded investigation identified a total of 844 patients whose records the employee may have accessed without an apparent business or treatment purpose. It is unclear whether all of these records were accessed inappropriately but, out of an abundance of caution, CPMC notified all of these patients.

    CPMC has determined that between October 2013 and October 2014, the employee accessed the following types of information without an apparent valid purpose: patient demographics, last four digits of social security number, clinical information including diagnosis and clinical notes, and prescription information. The type of information varied for each patient. While the employee potentially viewed the last four digits of some social security numbers, the employee did not have access to full Social Security numbers, driver’s license numbers, California identification numbers, credit card numbers or financial account information. CPMC has no evidence of a malicious intent or any unauthorized sharing of patient information by the employee. CPMC believes that the employee accessed the information out of curiosity.

    No action is required by the patients in response to CMPC’s notice.

    CPMC takes patient privacy very seriously. CPMC has also reiterated to all staff that policy allows them to access patient information only when necessary to perform job duties and that violating this policy may result in loss of employment.

    For questions, individuals may contact the Chief Privacy Officer for Sutter Health at 855-771-4220 Monday – Friday from 8am to 5pm.

    About California Pacific Medical Center (CPMC)—A Sutter Health Affiliate

    At San Francisco’s California Pacific Medical Center, we believe in the power of medicine. We research the most up-to-date treatments, hire the most qualified individuals, and practice the most modern, innovative medicine available. We deliver the highest-quality expert care with kindness and compassion in acute, post-acute and outpatient services, as well as preventive and complementary medicine. As one of California’s largest private, community-based, not-for-profit, teaching medical centers, and a Sutter Health affiliate, we are able to reach deep into our community to provide education, screening and financial support in some of the city’s most underserved neighborhoods. Like us on Facebook, watch us on YouTube and follow us on Twitter. For more information visit our web site at