You trust your doctor with your life. You tell them things you might not tell anyone else. Physicians are required to keep your health information confidential. But, are they? WZZM 13 investigated, and you might be surprised by what we found.
In our investigation, we found that patient's private medical information sometimes ends up in the trash. The Michigan Attorney General's office tells us identity thieves often go dumpster diving for information they can use to steal your identity, and your money. We discovered anyone can find some very personal information.
We checked dumpsters located near medical office buildings in the Grand Rapids area. We found some dumpsters were well protected by gates or locks. Some even had signs warning of surveillance. Other offices shredded their papers.
Not all information was well protected. We looked in ungated, unlocked dumpsters. Of those, we only found information in about half.
We found billing information, doctors' schedules, and some very personal information. In one dumpster we found a personal information form that a patient filled out when they went to the doctor's office. It included the person's name, address, social security number, date of birth, and more. We even found one woman's entire hospital discharge report, with all of her diagnosis.
So, what does the law say about this? HIPAA, the federal Health Insurance Portability and Accountability Act, lists 19 identifiers, or pieces of personal information, that are considered protected in a healthcare setting. Those include your name, address, date of birth, social security number, diagnosis, date of your appointment, and the list goes on.
For more details, we went to Denise Chrysler, the Privacy Officer for the Michigan Department of Community Health. She says, ?If these records contain any of those identifiers, that is considered protected health information."
We showed Chrysler what we found. She wondered, ?You said you're finding these things in dumpsters? ? I'm just surprised. I don't mean to be naive. But, I'm surprised that these sort of items would go into dumpsters without being shredded first."
When we asked if this type of information should be thrown into the trash, Chrysler said, ?Oh, of course not. No question. This information should be shredded or incinerated, or disposed of."
When we showed the documents to Assistant Attorney General Katharyn Barron, who heads the Consumer Protection Division, she saw red flags for identity theft. She said, ?There's no doubt as to what the social security number is. The person's birth date. Their address and even a phone number. You have what you need here to fill out a credit card application in this person's name. ? This is disturbing to know that this is out there and available."
We went back to the doctor' offices to find out how this information ended up in the trash.
Near the West Michigan Endodontists office, we found billing information like an office account number, but no actual diagnostic information. When we talked with the dentists, they were disappointed by our findings. They pointed out their system of separate boxes used to insure no patient information is tossed out. While they did not want to go on camera, Dr. Scott Hodges sent us a letter the day after our visit, saying, "We would like to thank you for encouraging us to do an even better job. As of 7:00 am today, all trash receptacles in the patient business area have been removed and only the previous receptacles for the incineration remain."
In a dumpster near Dr. Michael Crawford's Ophthalmology office, we found documents with patient information including their name, date of birth and when they came in for what type of eye exam. Dr. Crawford told me his office staff is careful to protect patient information. So, he is taking a closer look at how this happened, and how he can strengthen office security measures.
At Cascade Pediatrics we found lists of doctors' patients for the day, as well as some diagnostic information about the patients. The office gave us a statement saying, "We do have a policy and have tried to adhere to it. We have taken steps to keep our clients information private. If we have failed to keep this information private we will take the necessary steps to rectify it." We also spoke with an attorney for Cascade Pediatrics. He said it was not acceptable for patient information to be found in the dumpster and that the office is redoubling its efforts to protect patients' privacy.
In a dumpster outside Rehabilitation Medicine Associates, we found patient information including names and the purpose of the appointment, like sciatica or back pain. The Privacy Officer for Rehabilitation Medicine Associates told us the office does have a policy to protect patient's privacy and that staff are trained under HIPAA. She sent us a statement saying, "If the situation did occur as alleged, it was unintentional and involved human error. We will continue to take all steps necessary to protect the privacy of our patients."
In the same dumpster, outside the same medical office complex, we found multiple documents from OB/GYN, Dr. Dorsey Ligon's office. We found forms with patient's names, addresses, social security numbers, and other identifiers like where they work. We also found a patient's hospital discharge report with detailed information about her hysterectomy and her history of treatment for depression. It's a document that disturbed Denise Chrysler of the Department of Community Health. She asked, ?You said, in a dumpster?" That's right; we found the documents in an unprotected dumpster just outside of a doctor's office. Dr. Ligon's office gave us a statement about the strict measures in place to protect patient's privacy, including paper shredders throughout the office. The statement also says, "When a flaw in the system has been recognized we take immediate action to resolve the issue. Our patients can be assured that their expectation for privacy will be met."
All of these findings raised concerns for those who work with medical privacy issues. Chrysler says, ?For good health care, it's essential that people feel confident that whatever they say to their doctor or their other health care provider is going to be secure. If people don't have that confidence, they may omit very important information."
Chrysler says HIPAA requires that health professionals keep patient information private. But, the law is rather vague about how they are supposed to do that. We'll take a closer look at that in part two.
In all, we looked at about twenty dumpsters near medical facilities. About one-third were well secured by gates or locks, so we never looked inside. Of the dumpsters we actually checked, we found personal information in about half.
Amy Fox
In your voice
Play 
