Texas AG gets tough with Treatment Associates of Victoria
Technorati Tag: Security Breach
Date Reported:
9/29/08
Organization:
Treatment Associates of Victoria, Inc.
Contractor/Consultant/Branch:
None
Location:
San Antonio, Texas
Victims:
"customers"
Number Affected:
44
Types of Data:
"sensitive personal and medical information, including Social Security numbers, private medical history and substance abuse records"
Breach Description:
"SAN ANTONIO – Texas Attorney General Greg Abbott today charged Treatment Associates of Victoria, Inc., with violating the Texas Identity Theft Enforcement and Protection Act. According to court documents, the San Antonio-based drug testing and rehabilitation facility violated a state law that requires businesses to protect their customers’ sensitive information."
Reference URL:
Texas Attorney General Announcement
State of Texas, Plaintiff's Original Petition
LegalNewsline
Government Technology
Report Credit:
Texas Attorney General, Greg Abbott
Response:
From the online sources cited above:
SAN ANTONIO, Texas (Legal Newsline) -- Texas Attorney General Greg Abbott has filed charges against a San Antonio-based company for failing to protect its customers' personal information.
the Texas Attorney General has evidence that DEFENDANT is engaging in, has engaged in, or is about to engage in acts and practices which violate the State of Texas' identity theft prevention laws, as set forth below, namely failing to protect and safeguard from unlawful use or disclosure of consumers' sensitive personal information, collected or maintained by DEFENDANT in the regular course of business.
Treatment Associates of Victoria, Inc. is a drug testing and rehabilitation facility that had "unlawfully dumped bulk client records in publicly accessible garbage containers," Abbott said.
[Evan] A word of obvious advice. Don't throw confidential records away with the regular trash. Especially not in Texas!
TREATMENT ASSOCIATES is a drug testing and rehabilitation facility.
They [Treatment Associates] conduct routine drug testing and screening for entities such as Child Protective Services and United States Pretrial Services, Western District of Texas, as well as Texas Department of Criminal Justice, Pardons and Paroles Division.
The suit claims Treatment Associates was in violation of the Texas Identity Theft Enforcement and Protection Act
In truth and in fact, DEFENDANT failed to safeguard sensitive personal information and failed to maintain the confidentiality it promised to its clients.
At its location at 701 San Pedro, the files of 45 of DEFENDANT's clients were found in a publicly accessible dumpster.
[Evan] A
The records dumped by DEFENDANT and the sensitive personal identifying information contained in the files, can be described generally as follows:
DEFENDANT failed to shred, erase, or otherwise make the sensitive personal information unreadable
DEFENDANT misled consumers and caused confusion regarding the protection and security used to protect the sensitive and personal identifying information which was provided to DEFENDANT
By representing to consumers that "all information and records regarding [their] case are confidential" and then dumping its customers' sensitive and personal identifying information into trash receptacles making it easily accessible to the public…
DEFENDANT has, by means of these unlawful acts and practices, obtained money or other property from identifiable persons to whom such money or property should be restored or who, in the alternative, are entitled to an award of damages.
"Identity theft continues to be one of the most devastating white-collar crimes in the country," Abbott said. "This defendant faces severe penalties for failing to protect its clients' sensitive personal and medical information. The Office of the Attorney General will continue working to protect Texans from identity thieves."
The illegal dumping led to the sensitive information of 44 clients -- including medical information, Social Security numbers and substance abuse records -- to be exposed.
Treatment Associates is facing up to $50,000 per violation and civil penalties of up to $500 for each abandoned record.
[Evan] A good paper shredder is less than $100. One abandoned record can cost as much as $50,500. Do the math and come up with your own business decision.
The company is also charged with violating the Texas Deceptive Trade Practices Act (DTPA) and the Texas Health and Safety Code.
The additional violations could result in an additional $20,000 per violation of the DTPA and up to $25,000 per violation under the Health and Safety Code.
victims of identity theft spend an average of 600 hours over a two to four year period, as well as $1,400 or more, trying to clear their names
Facts cited by the Texas Attorney General in the Plaintiff's Original Petition:
Identity theft also imposes a substantial cost on businesses - in 2002 the total cost of losses to businesses due to identity theft in the United States was estimated at almost $50 billion.
The Legislature specifically recognized "dumpster diving" for discarded business records as a significant means through which identity theft is committed.
Commentary:
The Attorney General is seeking significant monetary fines. Refer to pages 12 and 13 of the Plaintiff's Original Petition. Say what you will about the Texas Attorney General Greg Abbott, but he is a serious enforcement official when it comes to identity theft legislation. He has taken numerous enforcement actions in the past few years.
We'll have to stay tuned to the outcome of this one.
Past Breaches:
Unknown
Date Reported:9/29/08
Organization:
Treatment Associates of Victoria, Inc.
Contractor/Consultant/Branch:
None
Location:
San Antonio, Texas
Victims:
"customers"
Number Affected:
44
Types of Data:
"sensitive personal and medical information, including Social Security numbers, private medical history and substance abuse records"
Breach Description:
"SAN ANTONIO – Texas Attorney General Greg Abbott today charged Treatment Associates of Victoria, Inc., with violating the Texas Identity Theft Enforcement and Protection Act. According to court documents, the San Antonio-based drug testing and rehabilitation facility violated a state law that requires businesses to protect their customers’ sensitive information."
Reference URL:
Texas Attorney General Announcement
State of Texas, Plaintiff's Original Petition
LegalNewsline
Government Technology
Report Credit:
Texas Attorney General, Greg Abbott
Response:
From the online sources cited above:
SAN ANTONIO, Texas (Legal Newsline) -- Texas Attorney General Greg Abbott has filed charges against a San Antonio-based company for failing to protect its customers' personal information.
the Texas Attorney General has evidence that DEFENDANT is engaging in, has engaged in, or is about to engage in acts and practices which violate the State of Texas' identity theft prevention laws, as set forth below, namely failing to protect and safeguard from unlawful use or disclosure of consumers' sensitive personal information, collected or maintained by DEFENDANT in the regular course of business.
Treatment Associates of Victoria, Inc. is a drug testing and rehabilitation facility that had "unlawfully dumped bulk client records in publicly accessible garbage containers," Abbott said.
[Evan] A word of obvious advice. Don't throw confidential records away with the regular trash. Especially not in Texas!
TREATMENT ASSOCIATES is a drug testing and rehabilitation facility.
They [Treatment Associates] conduct routine drug testing and screening for entities such as Child Protective Services and United States Pretrial Services, Western District of Texas, as well as Texas Department of Criminal Justice, Pardons and Paroles Division.
The suit claims Treatment Associates was in violation of the Texas Identity Theft Enforcement and Protection Act
In truth and in fact, DEFENDANT failed to safeguard sensitive personal information and failed to maintain the confidentiality it promised to its clients.
At its location at 701 San Pedro, the files of 45 of DEFENDANT's clients were found in a publicly accessible dumpster.
[Evan] A
The records dumped by DEFENDANT and the sensitive personal identifying information contained in the files, can be described generally as follows:
- social security numbers of clients;
- dates of birth of clients;
- the above-mentioned private information for family members and friends of clients and other third parties;
- names and dates of birth tied to social security numbers;
- private medical history of clients;
- criminal history of clients;
- personal history of clients;
- drug use and/or abuse history of clients; and
- generally private information that would be shared during a counseling session
DEFENDANT failed to shred, erase, or otherwise make the sensitive personal information unreadable
DEFENDANT misled consumers and caused confusion regarding the protection and security used to protect the sensitive and personal identifying information which was provided to DEFENDANT
By representing to consumers that "all information and records regarding [their] case are confidential" and then dumping its customers' sensitive and personal identifying information into trash receptacles making it easily accessible to the public…
DEFENDANT has, by means of these unlawful acts and practices, obtained money or other property from identifiable persons to whom such money or property should be restored or who, in the alternative, are entitled to an award of damages.
"Identity theft continues to be one of the most devastating white-collar crimes in the country," Abbott said. "This defendant faces severe penalties for failing to protect its clients' sensitive personal and medical information. The Office of the Attorney General will continue working to protect Texans from identity thieves."
The illegal dumping led to the sensitive information of 44 clients -- including medical information, Social Security numbers and substance abuse records -- to be exposed.
Treatment Associates is facing up to $50,000 per violation and civil penalties of up to $500 for each abandoned record.
[Evan] A good paper shredder is less than $100. One abandoned record can cost as much as $50,500. Do the math and come up with your own business decision.
The company is also charged with violating the Texas Deceptive Trade Practices Act (DTPA) and the Texas Health and Safety Code.
The additional violations could result in an additional $20,000 per violation of the DTPA and up to $25,000 per violation under the Health and Safety Code.
victims of identity theft spend an average of 600 hours over a two to four year period, as well as $1,400 or more, trying to clear their names
Facts cited by the Texas Attorney General in the Plaintiff's Original Petition:
Identity theft also imposes a substantial cost on businesses - in 2002 the total cost of losses to businesses due to identity theft in the United States was estimated at almost $50 billion.
The Legislature specifically recognized "dumpster diving" for discarded business records as a significant means through which identity theft is committed.
Commentary:
The Attorney General is seeking significant monetary fines. Refer to pages 12 and 13 of the Plaintiff's Original Petition. Say what you will about the Texas Attorney General Greg Abbott, but he is a serious enforcement official when it comes to identity theft legislation. He has taken numerous enforcement actions in the past few years.
We'll have to stay tuned to the outcome of this one.
Past Breaches:
Unknown
Posted by Evan Francen at 10/1/2008 2:36 PM 
Categories: Treatment Associates of Victoria, Insecure Discard
Categories: Treatment Associates of Victoria, Insecure Discard
Posts Atom 1.0
Comments