Since 2004, UCSF said it provided the names and addresses of 30,590 patients to Target America, paying the company $12,000 a year.

Hospital officials said it contracted with the company to assist "with identifying names of individuals who could potentially receive communications from UCSF."

"Identification of potential donors who were active in the philanthropic community was one objective, along with identifying individuals who had corporate relationships, such as board service, or were affiliated with relevant community programs and health care biomedical organizations," Kaarlela said.

After the breach was discovered, the hospital said it required Target America to hire "an objective third-party firm" to investigate. UCSF received the forensic analysis report March 26. It showed that information was potentially accessible from July 1 to Oct. 9 last year "if a query for a specific name was made." Notification letters were mailed to patients April 4.

To Dixon, the expert on medical identity, the disclosure lag was far too long.

"In Internet years, that's a century," she said.

In January, California began requiring health care providers to alert consumers if their medical information is breached. Swift notification is considered important so consumers can monitor credit reports and bills.

According to Joanne McNabb, chief of the California Office of Privacy Protection, notice should be given "in the most expedient time possible, without unreasonable delay."

"It's a judgment call, the how and the when part," McNabb said. "The idea is to give early warning so that people can take defensive action. On the other hand, you don't want to needlessly worry people."

It's not the worst case of lost records we've seen, but mining for donors seems so much worse than "whoops, lost another laptop!" At least people's social security numbers weren't included with the data. People who think their identity may have been stolen should pour themselves a stiff drink before sitting down to read this comprehensive post.

6,000 UCSF patients' data got put online [San Francisco Chronicle] (Thanks to Paul!)
(Photo: Getty)

Dr. Susan M. Trocciola, who was a resident in trauma medicine at the time, testified that she placed a finger in Mr. Persaud's rectal area after conducting a physical exam of his spine to check for a spinal-cord injury.
 
Whether the rectal exam was performed was a matter of dispute. Mr. Persaud testified that he felt a finger inserted in his rectum, but Dr. Trocciola said the exam was never carried out.

Mr. Persaud was not necessarily the most sympathetic plaintiff. It emerged during the trial that Mr. Persaud, a native of Guyana who did not complete high school, had been convicted of two misdemeanors: attempted aggravated harassment for making phone calls to an ex-girlfriend's mother in 2001 and criminal mischief for threatening a fellow motorist with a baseball bat after a minor car accident in 2007. Mr. Persaud had filed a workers' compensation claim and also sued the owner of the site where he was injured. He was awarded about $4,000 in the compensation claim, but the suit was settled for a negligible sum, Mr. Marrone said.
 
In a phone interview, Mr. Marrone said of his client, "He's not a perfect person, but he's not a criminal by any standard of the word. He's got a lot of anxiety. He reacts negatively in stressful situations and he has a short temper."

RELATED
"Doctor Forces Rectal Exam, Patient Punches Doctor, Police Arrest Patient, Patient Sues"
(Photo: Getty)