PATIENT PRIVACY BREACHED
10:00 PM PDT on Friday, July 16, 2010
Twice in the past two months, confidential medical records containing patients' names, addresses, dates of birth and Social Security numbers have been discarded where anyone could find them.
The first incident occurred May 31, when a sheriff's deputy found hundreds of medical files in a trash bin in Chino Hills.
The second happened Wednesday, when a passerby noticed several boxes of medical records outside a dental office in Barstow.
In the first case, the records were returned to the husband-wife team of a pediatrician and an obstetrician-gynecologist, who said they were accidentally discarded during an office move.
In the second, the Sheriff's Department seized the records for destruction after a dentist and his staff acknowledged the records had been outside for a month.
The incidents are disturbing on several levels:
Patients' confidentiality was compromised. Information they may not have chosen to share even with family members or close friends was exposed to strangers.
Careless handling of birth dates and Social Security numbers is a recipe for identity theft, which can be financially devastating.
There are no requirements to notify patients that their medical records have been compromised.
There are no guidelines on how abandoned medical records should be handled by agencies or others who find them.
There are no clear guidelines on reporting breaches of confidentiality.
This isn't the fault of the San Bernardino County Sheriff's Department. It's to be commended for getting the word out through news releases that people who were these doctors' and dentists' patients should be on guard for identity theft.
In the Chino Hills case, a report was sent to the Medical Board of California, which is investigating.
Medical Board spokeswoman Candis Cohen said failing to dispose of medical records properly can result in fines of $2,500 to $25,000.
In Barstow, the deputy wisely took the records.
Abandoning health care records isn't a crime.
But violations of federal health-privacy law can be reported to the U.S. Health and Human Services, which can impose penalties of $10,000 to $50,000.
Breaches also can be reported to the California Office of Privacy Protection (privacy.ca.gov).
Director Joanne McNabb said dealing with abandoned medical records presents a Catch-22: The medical professional who abandoned them is responsible for disposing of them properly. Often, he or she can't be found.
Landlords and storage facility managers are often left holding the bag. Do they foot the bill for shredding the records or storing them?
McNabb said medical charts contain irreplaceable information and perhaps shouldn't be destroyed.
But who foots the bill for finding the patients and returning their charts to them?
There are a lot of unanswered questions.
The recently created state Office of Health Information Integrity should ask policymakers to clarify the rules.
Cassie MacDuff can be reached at 951-368-9470 or cmacduff@PE.com
Back
