Find other people to have your back
A St. Luke's patient told the ABC affiliate, "You feel relieved that [St. Luke's physicians] take care of you and I think that it's very important to feel like a human being."
This statement is much, much more impactful than anything Singer, Kersh, or Browner has said so far. And that is mostly because the patient is viewed as an impartial third party and, therefore, a more trustworthy source.
That's why it's critical in any crisis situation to identify patients, organizations, and other credible stakeholders who have your back and are willing to say so on the record. The public will be more inclined to believe you if sources they trust confirm your story.
Foster a culture of preventing crises
As of this writing, CPMC has not addressed the leak itself. To me, the part of this story that sets off the most alarm bells is the question of whether someone inside Sutter Health or CPMC intentionally leaked these documents to the city of San Francisco.
This is pure speculation on my part, since CPMC hasn't said anything to the contrary. And since no one else has said otherwise, I have to entertain the notion that it was an inside job, which doesn't sit well with me or, I imagine, CPMC's patients, staff, or benefactors.
Or perhaps a political foe or an alien not from the planet Earth (wink, wink, San Singer) snuck into the CEO's office and stole the documents, which was actually one of several drafts generated by some computer model.
If you don't want to have to deal with a public relations disaster, don't create a potentially disastrous situation. And for the times when it can't be avoided, when it's truly out of your hands, make sure you have a fool-proof crisis communications plan in place.
At the very least, don't accuse your detractors of being Martians.