There is an axiom in show business that says always leave them wanting more. And while the rogue employee has gotten quite a bit of attention in this corner of late, that scoundrel has raised its head again in another circumstance that bears mentioning, nonetheless. Apparently, he or she is working on the maintenance staff at an Oregon health care system and his or her work raises more serious questions than it answers.
A little over two weeks ago, the Corvallis Gazette Times reported that Samaritan Health Services was conducting an internal investigation into the improper handling of its patient medical records. This, after a stack of un-shredded medical documents was found in an outside trash can behind its medical offices by a woman who travels there from nearby Newport for care.
According to Janet Wood, she opened a trash can to throw away some tissues when she discovered what appeared to be patient medical records in the garbage. No doubt curious and probably concerned, she grabbed a stack of papers off the top and sifted through them. Although she didn’t have her glasses on, she was able to see some things in bold print — such as one that said “pregnancy results,” and another that said “diagnosis,” – as well as lots of signed prescriptions for narcotics.
Evidently, someone called the authorities and the Corvallis police department responded to the scene along with employees of the Samaritan Family Medicine Resident Clinic. According to CPD’s Captain Dave Henslee, the trashed records bore the address of that Samaritan division although because Wood told the responding officer that the paperwork was confidential in nature, he did not examine the documents. Henslee also indicated that his agency took no further action because no crime had seemingly been committed.
On their end, however, Samaritan Family Medical Resident Clinic employees literally had their hands full. Wood told the newspaper that there was more than just one stack of papers in the garbage and that after Samaritan workers started taking documents out by hand, “they realized that the garbage can was all the way full of them, so they took the entire garbage can.”
The Gazette-Times noted that in order for the discarded paperwork to have constituted a HIPAA breach, it would have had to have contained individually identifiable health information — like patients’ names — and that Wood hadn’t looked closely enough to see if that was present. On the other hand, if she had seen prescriptions, clinical diagnoses, and test results, it is hard to fathom how some identifiable information would not have been contained thereon, unless patients in the Samaritan Health Services system are assigned blind, random patient numbers for treatment purposes and all references would only be to such numbers.
All of this matters not, for purposes of this rogue custodian analysis.
Wood recalled for the Times-Gazette that someone from Samaritan Health Services contacted her about an hour after she found the records in the trash to inform her that the matter was under investigation and that Samaritan “believed that it was the cleaning person that mistakenly took it out to the garbage.” Accidents do happen and that may ultimately prove to be the case in this instance.
After the story broke, Janelle Iverson, a Samaritan Health Services spokeswoman, said that the company takes patient privacy very seriously and confirmed that the records snafu was the subject of an internal investigation. She would not provide details about the case or of Samaritan’s protocols in disposing of confidential medical documents to the Times-Gazette, but indicated that Samaritan’s staff is regularly trained on multiple protocols that are in place to protect confidential patient information. The newspaper did not report as her commenting on the custodial slip-up angle.
But if a rogue custodian was responsible for this data breach, then more questions are raised than answered about (1) Samaritan’s handling and storage of medical records when not in use; (2) access to medical records by non-essential, non-medical health system personnel; (3) and the overall nature and effectiveness of controls on access to such information – in both paper and electronic forms – by all classifications of employees.