Officials at the California Hospital Assn. said the trade group has taken no position on the legislation but is concerned that the state not penalize hospitals for inadvertent privacy breaches. The group is also concerned that hospitals could be penalized for the actions of rogue employees even when appropriate steps had been taken to protect patient confidentiality.
But Jones said the impetus for action is clear.
"I take it at face value that health facilities do think this is important," he said. "But at the end of the day, there are far too many intrusions of patient privacy as a result of these breaches, and it needs to be brought to a stop."
A major finding of the state's new report on UCLA is that Jackson was able to view the records of more than 900 people by using her supervisor's password. In most cases, she could see patients' Social Security numbers, addresses, health insurance and other personal information. Officials were able to connect Jackson to each case by examining her workstation, Billingsley said.
Among those were two previously unreported cases in which representatives of the celebrities complained in October and November 2004 when details of their hospitalizations appeared in the national media.
In November 2004, for instance, the New York Post reported that actress Shelley Long, best-known for her role in the TV series "Cheers," was hospitalized at UCLA. Her manager at the time said she became ill from medication to treat back pain.
The state report does not identify Long by name but includes dates of hospitalization that match when the Post said Long was at UCLA.
In the second case, another celebrity's representative complained to UCLA after a national newspaper "ran a front page story about [the patient's] surgery at the facility" in October 2004. The representative also complained that he was told that the information was obtained from an "inside source at the hospital."
In addition to Jackson, another employee looked at the second celebrity's records in May 2005 and again in November 2005.
That employee was suspended in July 2008 after the breach was discovered.
When reached by phone Monday afternoon, Jackson said, "I don't have any comment."
In April, she told The Times that she was "being nosy" when she looked at celebrity records.
"I didn't leak anything or anything like that," she said at the time. "It wasn't for money or anything. It was just looking."
Jackson was indicted by a federal grand jury April 9 on a charge of obtaining individually identifiable health information for commercial advantage.
Fawcett and her lawyers allege that Jackson leaked personal information about Fawcett's battle with cancer to the National Enquirer and other tabloids.
According to a document reviewed by The Times, the supervisor whose password Jackson used is Alice Chan. Chan, who still works at UCLA as an intensive care unit director, declined to comment.
In his statement, Feinberg said UCLA would continue to devote its attention to improving patient privacy.
"We can't undo the wrongs of the past," he said. "But we can and are redoubling our efforts to not only improve our training and security systems, but to create a culture where this type of behavior will not take place."
--
charles.ornstein@latimes.com
