HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Hundreds of Medical Records Found Scattered in Street

The medical records, billing statements, registration information, and accounting records of hundreds of patients of Fort Myers-based Radiology Regional Center have been found scattered in the street following an accident that occurred during transportation from storage.

The records, many of which were over ten years old, had been arranged to be collected from the healthcare provider’s offices and taken to the country incinerator to be destroyed.

However, when the country collected the records, its workers failed to secure the rear doors of the vehicle used to transport the boxes. The records fell from the vehicle into the street. Paper files containing highly sensitive information were discovered littered on Fowler Street, and had found their way into doorways, canals, and were scattered all over the sidewalk.

HIPAA Rules require all medical records to be permanently destroyed when they are no longer required, and in accordance with HIPAA rules, Radiology Regional Center had arranged for the records to be disposed of securely. Many facilities lack the resources to securely destroy records, so they must therefore be transported to other locations. The Transportation of records is also covered by HIPAA Rules. All physical records must be secured during transit to prevent accidental exposure or theft.

Please see the HIPAA Journal Privacy Policy

The contract Radiology Regional Center had with the county required the files to be transported in double locked containers; however, it would appear that country workers failed to notice that the door to the vehicle had not been locked.

When the boxes fell from the vehicle the files spilled into the street causing a major traffic tie up. While some of the records have been recovered, it is possible that some documents have been taken by members of the public. Consequently, patients have been placed at risk of suffering harm or losses as a result of the accident.

Radiology Regional Center is now in the process of notifying all patients affected by the incident, and the Department of Health and Human Services’ Office for Civil Rights has also been notified of the data breach.

According to a statement released by a country spokeswoman, “Standard operating procedures were followed.” However, she also said “In light of this incident, solid waste staff will be reviewing its operating procedures.”

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.