Select Medical Corporation charged by the Texas Attorney General
Technorati Tag: Security Breach
Date Reported:
1/11/08
Organization:
Select Medical Corporation
Contractor/Consultant/Branch:
Select Physical Therapy Texas Limited Partnership
Victims:
Patients
Number Affected:
Unknown*
*"more than 4,000 pieces of its customers’ sensitive information"
Types of Data:
Names, addresses, treatment details, telephone numbers, credit and debit card information, and Social Security numbers.
Breach Description:
The State of Texas Attorney General, Greg Abbott announced the taking of legal action against Select Physical Therapy Texas Limited Partnership and its parent company, Select Medical Corporation, for systematically exposing their customers to identity theft risk. According to the filing, Select "exposed more than 4,000 pieces of its customers’ sensitive information, including Social Security numbers."
Reference URL:
The Texas State Attorney General announcement
The Associated Press Story on KXAN News
Report Credit:
The Texas State Attorney General
Response:
From the online sources cited above:
Select Physical Therapy Texas Limited Partnership cited for exposing customers’ medical records
Texas Attorney General Greg Abbott took legal action today against Select Physical Therapy Texas Limited Partnership and its parent company, Select Medical Corporation, for systematically exposing their customers to identity theft risk.
[Evan] Greg Abbott has shown that he is a real champion against companies that don't adequately secure confidential and personal information. This is at least the fifth action he has taken against companies in regards to identity theft protection.
Investigators with the Office of the Attorney General discovered that Select Physical Therapy Texas Limited Partnership, also known as HealthSouth Rehabilitation Center, exposed more than 4,000 pieces of its customers’ sensitive information, including Social Security numbers.
[Evan] There was a little confusion as to whether or not HealthSouth the company was implicated, they were not. It turns out that HealthSouth is not involved at all.
The state’s investigation was launched after reports from the Levelland Police Department indicated that bulk customer records were dumped in garbage containers behind a local building. Select Physical Therapy Texas Limited Partnership occupied the building until closing its office in October 2007.
According to Attorney General investigators, the records also contained credit and debit card information, names, addresses, and telephone numbers. The boxes also contained copies of checks from several large corporations who contracted with Select Physical Therapy Texas Limited Partnership to conduct employee physicals and drug screenings.
Investigators also discovered sensitive medical information among the records, including initial evaluation and plan of care forms, insurance verification sheets, drug and alcohol testing verification forms, and social and vocational therapy questionnaires.
“The defendants are charged with improperly – and unlawfully – disposing of sensitive personal information, including medical records,” Attorney General Abbott said. “By failing to comply with the Identity Theft Enforcement and Protection Act, the defendants not only violated the law, they exposed their customers to identity theft."
"We are grateful to the Levelland Police Department for vigilantly uncovering and reporting the improper disposal of these sensitive records.”
[Evan] Good work Levelland P.D.!
The Act gives the Office of the Attorney General authority to seek penalties of up to $50,000 per violation.
The Attorney General also charged Select Physical Therapy Texas Limited Partnership and Select Medical Corporation with violating Chapter 35 of the Business and Commerce Code, which requires businesses to develop retention and disposal procedures for their clients’ personal information. The law provides for civil penalties of up to $500 for each abandoned record.
Attorney General investigators are also working to determine if any exposed data has been used illegally.
Consumers who wish to file a complaint may contact the Office of the Attorney General at or file a complaint online at www.oag.state.tx.us.
Commentary:
Don't mess with Texas.
Seriously, this is excellent news. Organizations should take notice (but will they?). Just because sensitive information no longer has use to an organization, does not mean that protection stops. Information that no longer has any authorized business use needs to be destroyed (or returned it's owner) in a secure manner (How many people read this and say to themselves "Duh!"?). Many of the companies we consult for now have data destruction and re-use standards that dictate exactly what secure destruction is and how to carry it out properly.
Kudos to Greg Abbott and the Levelland Police Department. I am looking forward to the outcome.
Other companies that the Texas State Attorney General has taken action against include; Minnesota-based Life Time Fitness, CVS Pharmacy, RadioShack, CNG Financial Corporation, and EZPAWN and EZMONEY Loan Services.
Past Breaches:
Unknown
Date Reported:1/11/08
Organization:
Select Medical Corporation
Contractor/Consultant/Branch:
Select Physical Therapy Texas Limited Partnership
Victims:
Patients
Number Affected:
Unknown*
*"more than 4,000 pieces of its customers’ sensitive information"
Types of Data:
Names, addresses, treatment details, telephone numbers, credit and debit card information, and Social Security numbers.
Breach Description:
The State of Texas Attorney General, Greg Abbott announced the taking of legal action against Select Physical Therapy Texas Limited Partnership and its parent company, Select Medical Corporation, for systematically exposing their customers to identity theft risk. According to the filing, Select "exposed more than 4,000 pieces of its customers’ sensitive information, including Social Security numbers."
Reference URL:
The Texas State Attorney General announcement
The Associated Press Story on KXAN News
Report Credit:
The Texas State Attorney General
Response:
From the online sources cited above:
Select Physical Therapy Texas Limited Partnership cited for exposing customers’ medical records
Texas Attorney General Greg Abbott took legal action today against Select Physical Therapy Texas Limited Partnership and its parent company, Select Medical Corporation, for systematically exposing their customers to identity theft risk.
[Evan] Greg Abbott has shown that he is a real champion against companies that don't adequately secure confidential and personal information. This is at least the fifth action he has taken against companies in regards to identity theft protection.
Investigators with the Office of the Attorney General discovered that Select Physical Therapy Texas Limited Partnership, also known as HealthSouth Rehabilitation Center, exposed more than 4,000 pieces of its customers’ sensitive information, including Social Security numbers.
[Evan] There was a little confusion as to whether or not HealthSouth the company was implicated, they were not. It turns out that HealthSouth is not involved at all.
The state’s investigation was launched after reports from the Levelland Police Department indicated that bulk customer records were dumped in garbage containers behind a local building. Select Physical Therapy Texas Limited Partnership occupied the building until closing its office in October 2007.
According to Attorney General investigators, the records also contained credit and debit card information, names, addresses, and telephone numbers. The boxes also contained copies of checks from several large corporations who contracted with Select Physical Therapy Texas Limited Partnership to conduct employee physicals and drug screenings.
Investigators also discovered sensitive medical information among the records, including initial evaluation and plan of care forms, insurance verification sheets, drug and alcohol testing verification forms, and social and vocational therapy questionnaires.
“The defendants are charged with improperly – and unlawfully – disposing of sensitive personal information, including medical records,” Attorney General Abbott said. “By failing to comply with the Identity Theft Enforcement and Protection Act, the defendants not only violated the law, they exposed their customers to identity theft."
"We are grateful to the Levelland Police Department for vigilantly uncovering and reporting the improper disposal of these sensitive records.”
[Evan] Good work Levelland P.D.!
The Act gives the Office of the Attorney General authority to seek penalties of up to $50,000 per violation.
The Attorney General also charged Select Physical Therapy Texas Limited Partnership and Select Medical Corporation with violating Chapter 35 of the Business and Commerce Code, which requires businesses to develop retention and disposal procedures for their clients’ personal information. The law provides for civil penalties of up to $500 for each abandoned record.
Attorney General investigators are also working to determine if any exposed data has been used illegally.
Consumers who wish to file a complaint may contact the Office of the Attorney General at or file a complaint online at www.oag.state.tx.us.
Commentary:
Don't mess with Texas.
Seriously, this is excellent news. Organizations should take notice (but will they?). Just because sensitive information no longer has use to an organization, does not mean that protection stops. Information that no longer has any authorized business use needs to be destroyed (or returned it's owner) in a secure manner (How many people read this and say to themselves "Duh!"?). Many of the companies we consult for now have data destruction and re-use standards that dictate exactly what secure destruction is and how to carry it out properly.
Kudos to Greg Abbott and the Levelland Police Department. I am looking forward to the outcome.
Other companies that the Texas State Attorney General has taken action against include; Minnesota-based Life Time Fitness, CVS Pharmacy, RadioShack, CNG Financial Corporation, and EZPAWN and EZMONEY Loan Services.
Past Breaches:
Unknown
Posted by Evan Francen at 1/11/2008 4:13 PM 
Categories: Select Medical Corporation, Insecure Discard
Categories: Select Medical Corporation, Insecure Discard
Posts Atom 1.0
Greg Abbott is about as crooked as they come, and comes from a family of thieves. I dont buy his story, nor do I believe he is interested in the protection of peoples rights. The simple fact is this: Select Medical is worth billions of dollars, and he sees dollars signs. Easy target, simple mistake made "because of a few stupid texans". End of story.
Reply to this