Dental patient information found in the street
Technorati Tag: Security Breach
Date Reported:
10/14/08 (UPDATED 10/29/08, "After being bombarded by upset patients last week, Aspen Dental has responded to patients' frustrations with a new policy that will help prevent future breaches in patient confidentiality." A patient noticed something while she was checking in... "It was a shredder," she said. "And they were using it, too." Source: The Telegraph)
Organization:
Aspen Dental
Contractor/Consultant/Branch:
Nashua, New Hampshire Branch
Location:
Nashua, New Hampshire
Victims:
Patients
Number Affected:
"At least 60"
Types of Data:
Name, home address, date of birth, telephone number, email address, dental insurer, and last four digits of Social Security number
Breach Description:
"NASHUA, N.H. (AP) - Aspen Dental is trying to find out how confidential, patient dental records wound up on a busy Nashua, N.H., street."
Reference URL:
The Telegraph
Associated Press via WCAX Channel 3 News
Report Credit:
Albert McKeon and Andrew Spinali, The Telegraph and a special thanks to informed reader Rob at InsideIDTheft.info
Response:
From the online sources cited above:
NASHUA - At least 60 patients of Aspen Dental won't be smiling after learning their confidential paperwork was lying on a busy public street for all to see.
Somehow, documents detailing everything from dental history to billing and personal information of customers were spread across Amherst Street on Tuesday morning.
[Evan] Not just a privacy issue, but littering too. There's got to be a fine here somewhere, don't you think?
A broken trash bag was found near where the papers lay, and the scattered contents included a few pairs of latex gloves.
The company said the material was picked up Tuesday by a trash hauler, but it's not clear how it ended up on the edge of Route 101A.
"It doesn't make me feel too confident or too happy to think that stuff like that is floating around," said Hollis resident Tavis McKee, who had work performed last week at Aspen Dental's Amherst Street office.
[Evan] It's good to know that there are plenty of other dentists that would be glad to take Mr. McKee as a patient. Does an incident like this give a patient good cause to change? I don't think there are many people out there who ask a medical/dental provider questions about their information security practices. Maybe we just assume too much.
McKee's address, phone number, email address, date of birth, and dental insurer were listed on a single sheet.
The paper also included his account balance and a portion of McKee's Social Security number.
[Evan] According to another story, only the last four digits were disclosed. Aspen deserves some credit for masking the other six digits of Social Security numbers. It should be noted that the other information can still be damaging if it were disclosed to the wrong person. The more information a criminal knows about you, the more information the criminal can gain about you (potentially).
"I'm definitely going to have a talk with them," McKee said. "It's concerning that they're not shredding the information and just throwing it away in the trash. I know it's only the last four digits of my Social, but what if it was more?"
[Evan] It was more.
Hudson resident Fred Wilkie said he was disappointed that information Aspen Dental was supposed to keep confidential was suddenly up for grabs.
One paper revealed the last four digits of his Social Security number, plus his address, date of birth, phone number and type of dental work.
"I usually don't throw away any confidential information," Wilkie said. "I try to shred it."
[Evan] Obviously a good idea.
According to Aspen Dental spokesperson Mark Frank, Aspen administrators have been in contact with Waste Management, the company contracted for the Nashua branch's waste removal.
[Evan] This ain't a Waste Management issue.
Frank said that the waste was picked up Tuesday morning, but what happened after that is still under investigation.
Frank said that Aspen Dental adheres to the federal regulations about patient privacy, which do not specify shredding documents.
[Evan] What a wonderful excuse for not doing the right thing! Its like, "The government didn't tell us we needed to do it, so we didn't". The government doesn't tell you that you need to take a shower either, but you do (hopefully).
"We treat the protection of patient information very seriously," Frank said. "We dispose of patient records and information in accordance with HIPAA rules and regulations."
[Evan] This statement could be argued and I question the logic.
Frank said that, while Aspen Dental apologizes for the incident, the miscue was out of their hands.
[Evan] Yeah! It was Waste Management's fault!
"We certainly regret this unfortunate accident, which was out of the control of Aspen Dental," he said. "We've assured them that we're doing everything in our power to make sure that the situation is rectified as quickly as possible."
[Evan] Puhleez!
The Telegraph collected paperwork with the information of 61 patients.
The papers were gathered about an hour after a Bellwether Community Credit Union employee informed the newspaper of the spill.
The paperwork was on the street, the lawn of the credit union, and on the construction site of a Hampton Inn & Suites hotel next door.
Some of the paperwork showed only a few details - such as street address and date of appointment - but the unauthorized release of those facts is still prohibited by HIPAA.
Some papers were copies of the dental office's patient schedule; others listed only patients' procedures and the costs.
"This is a privacy issue," said a Merrimack resident, whose records were found and who asked not to be named.
"I don't want information about my son being out there where anyone can get it. These papers need to be shredded. It bothers me, too, because this information should be kept in his files."
Wilkie, of Hudson, already knows he's not going back to Aspen Dental.
He said the staff there asked him to stop coming because he refused to have any more "costly" dental work.
"Evidently, they threw my records away," he said.
Commentary:
Social Security numbers and Credit/Debit card numbers are not the only types of information that are meant to be confidential. Just because these types of information were not disclosed, does not mean that the disclosure of the other information couldn't be used (or leveraged) to wreak havoc.
In my opinion, the incident itself was bad enough, but the response was terrible. As a consumer, thank God I have choices.
Past Breaches:
Unknown
Date Reported:10/14/08 (UPDATED 10/29/08, "After being bombarded by upset patients last week, Aspen Dental has responded to patients' frustrations with a new policy that will help prevent future breaches in patient confidentiality." A patient noticed something while she was checking in... "It was a shredder," she said. "And they were using it, too." Source: The Telegraph)
Organization:
Aspen Dental
Contractor/Consultant/Branch:
Nashua, New Hampshire Branch
Location:
Nashua, New Hampshire
Victims:
Patients
Number Affected:
"At least 60"
Types of Data:
Name, home address, date of birth, telephone number, email address, dental insurer, and last four digits of Social Security number
Breach Description:
"NASHUA, N.H. (AP) - Aspen Dental is trying to find out how confidential, patient dental records wound up on a busy Nashua, N.H., street."
Reference URL:
The Telegraph
Associated Press via WCAX Channel 3 News
Report Credit:
Albert McKeon and Andrew Spinali, The Telegraph and a special thanks to informed reader Rob at InsideIDTheft.info
Response:
From the online sources cited above:
NASHUA - At least 60 patients of Aspen Dental won't be smiling after learning their confidential paperwork was lying on a busy public street for all to see.
Somehow, documents detailing everything from dental history to billing and personal information of customers were spread across Amherst Street on Tuesday morning.
[Evan] Not just a privacy issue, but littering too. There's got to be a fine here somewhere, don't you think?
A broken trash bag was found near where the papers lay, and the scattered contents included a few pairs of latex gloves.
The company said the material was picked up Tuesday by a trash hauler, but it's not clear how it ended up on the edge of Route 101A.
"It doesn't make me feel too confident or too happy to think that stuff like that is floating around," said Hollis resident Tavis McKee, who had work performed last week at Aspen Dental's Amherst Street office.
[Evan] It's good to know that there are plenty of other dentists that would be glad to take Mr. McKee as a patient. Does an incident like this give a patient good cause to change? I don't think there are many people out there who ask a medical/dental provider questions about their information security practices. Maybe we just assume too much.
McKee's address, phone number, email address, date of birth, and dental insurer were listed on a single sheet.
The paper also included his account balance and a portion of McKee's Social Security number.
[Evan] According to another story, only the last four digits were disclosed. Aspen deserves some credit for masking the other six digits of Social Security numbers. It should be noted that the other information can still be damaging if it were disclosed to the wrong person. The more information a criminal knows about you, the more information the criminal can gain about you (potentially).
"I'm definitely going to have a talk with them," McKee said. "It's concerning that they're not shredding the information and just throwing it away in the trash. I know it's only the last four digits of my Social, but what if it was more?"
[Evan] It was more.
Hudson resident Fred Wilkie said he was disappointed that information Aspen Dental was supposed to keep confidential was suddenly up for grabs.
One paper revealed the last four digits of his Social Security number, plus his address, date of birth, phone number and type of dental work.
"I usually don't throw away any confidential information," Wilkie said. "I try to shred it."
[Evan] Obviously a good idea.
According to Aspen Dental spokesperson Mark Frank, Aspen administrators have been in contact with Waste Management, the company contracted for the Nashua branch's waste removal.
[Evan] This ain't a Waste Management issue.
Frank said that the waste was picked up Tuesday morning, but what happened after that is still under investigation.
Frank said that Aspen Dental adheres to the federal regulations about patient privacy, which do not specify shredding documents.
[Evan] What a wonderful excuse for not doing the right thing! Its like, "The government didn't tell us we needed to do it, so we didn't". The government doesn't tell you that you need to take a shower either, but you do (hopefully).
"We treat the protection of patient information very seriously," Frank said. "We dispose of patient records and information in accordance with HIPAA rules and regulations."
[Evan] This statement could be argued and I question the logic.
Frank said that, while Aspen Dental apologizes for the incident, the miscue was out of their hands.
[Evan] Yeah! It was Waste Management's fault!
"We certainly regret this unfortunate accident, which was out of the control of Aspen Dental," he said. "We've assured them that we're doing everything in our power to make sure that the situation is rectified as quickly as possible."
[Evan] Puhleez!
The Telegraph collected paperwork with the information of 61 patients.
The papers were gathered about an hour after a Bellwether Community Credit Union employee informed the newspaper of the spill.
The paperwork was on the street, the lawn of the credit union, and on the construction site of a Hampton Inn & Suites hotel next door.
Some of the paperwork showed only a few details - such as street address and date of appointment - but the unauthorized release of those facts is still prohibited by HIPAA.
Some papers were copies of the dental office's patient schedule; others listed only patients' procedures and the costs.
"This is a privacy issue," said a Merrimack resident, whose records were found and who asked not to be named.
"I don't want information about my son being out there where anyone can get it. These papers need to be shredded. It bothers me, too, because this information should be kept in his files."
Wilkie, of Hudson, already knows he's not going back to Aspen Dental.
He said the staff there asked him to stop coming because he refused to have any more "costly" dental work.
"Evidently, they threw my records away," he said.
Commentary:
Social Security numbers and Credit/Debit card numbers are not the only types of information that are meant to be confidential. Just because these types of information were not disclosed, does not mean that the disclosure of the other information couldn't be used (or leveraged) to wreak havoc.
In my opinion, the incident itself was bad enough, but the response was terrible. As a consumer, thank God I have choices.
Past Breaches:
Unknown
Posts Atom 1.0
Comments