Billing Records Mixed with Recyclables Causes Breach

A mix-up by a janitorial services firm has resulted in a major data breach at a 19-member radiology group practice in Springfield, Mo.

Litton and Giddings Radiological Associates has notified about 13,000 patients who had billing activity between July 23 and August 2 of 2012.

“On August 10, 2012, LGRA learned from its billing company that the janitorial services vendor managed by the billing company’s landlord had inadvertently sent paper billing records to a Springfield recycling center without first shredding the records,” according to the notice sent to patients. “More specifically, on two occasions, July 31 and August 2, 2012, a janitor removed documents from the locked shred bin and placed them in a different, but secured container with other recyclable materials. The secured container was transported to the recycling center where the items were sorted for recycling, and ultimately, completely destroyed. The recycling process is largely mechanized, but workers in the recycling facility do, at times, manually sort the materials.”

Litton and Giddings’ billing firm was unable to identify which documents were involved, but believes compromised protected health information “generally” would have included names, addresses, dates of birth, diagnosis codes and /or Social Security numbers, according to the practice. Consequently, all patients with billing activity during the time period in question were notified.

The practice also has notified the HHS Office for Civil Rights of the breach. The practice will offer credit protection services on an individual basis “to each patient as necessary,” according to a spokesperson, who was not authorized to further explain.