You are a reporter looking into medical errors, and you get a tip from multiple sources: In 2007, a surgeon at DePaul Health Center took out the wrong kidney from a patient.

You think it might be information that patients in need of a surgeon would be interested in knowing.

And if it happened, it's serious, and many agencies would have gotten involved.

You start with the Joint Commission, an organization that accredits hospitals. It confirms a "wrong-site" surgery occurred at DePaul in 2007 but won't tell you more.

Someone probably sued, right? But no court file exists.

The state tracks all malpractice claims, even those that don't end up in court. So, you ask the Missouri Division of Insurance for a copy of its malpractice database. The agency removes identifiers before providing it.

Among the 18,000 malpractice cases in the past decade, there are just two involving wrong-site surgeries in St. Louis in 2007. One involves urology. The surgeon and his practice paid the patient about $1.7 million without having to file a lawsuit. Could that be it?

You download the National Practitioner Data Bank, which contains information on doctors who paid malpractice claims or have been professionally disciplined. (Well, not the real data bank — that's for health care providers only — but the one for public use, scrubbed clean of identifiers.)

You sort it for payments of $1.7 million for wrong-site surgeries in Missouri. There is just one. The surgeon was in his 50s and got his medical degree in the 1980s. The patient was a man in his 50s who was significantly and permanently injured.

This could be right, but you need documentation.

You try the Missouri Department of Health and Senior Services, which investigates errors at hospitals. You wait a month for the state to send you its DePaul reports, which cost $72 to copy.

One report includes a reference to a serious error in December 2007 that seems connected to a review of urologic surgery at DePaul. No names are used.

But the report details many problems involving urology at DePaul. For instance, several surgeons were performing "minimally invasive" procedures without record of proper credentials.

One of them involved a patient who came in for a nephrectomy — removal of a diseased kidney. The surgeon hadn't completed a medical history of the 55-year-old patient in advance, and hand-wrote one the day of surgery — Dec. 13, 2007.

Was that the wrong-site surgery? you ask state regulators. They will say only that the review of DePaul's urology department is based on a wrong-kidney surgery but won't acknowledge that it was the Dec. 13 case.

Federal regulators say the report doesn't explain what went wrong in the surgery because it was found to be the sole fault of the doctor. They turned the case over to the Missouri Board of Professional Registration for the Healing Arts, which disciplines doctors, in early 2008.

You check disciplinary actions against Missouri doctors. None involves taking the wrong kidney out of someone.

You ask DePaul about it. Hospital officials say that even acknowledging such a mistake would violate federal law on patient confidentiality.

This is all you can find out in Missouri. Then you use Google to search for "wrong kidney" and "hospital."

Nothing on DePaul, but there is a case in Minneapolis that sounds similar.

Less than a week after a surgeon removed a wrong kidney in 2008, Methodist Hospital issued a press release apologizing for a "tragic medical error" and explaining what happened.

A state health official cheered the move, telling a newspaper that "being transparent is a major step forward in patient safety."