STUDENT RECORDS FOUND IN FIELD

March 30th, 2011

The Killeen Independent School District has begun looking into what it calls an “unfortunate incident” that involved documents containing social security numbers and other sensitive data being disposed of in a field near Ellison High School. “KISD takes the protection of student and employee information very seriously,” KISD spokeswoman Leslie Gilmore said. “It’s something we pride ourselves on and we want to make sure we protect that. This is an unfortunate incident that will be thoroughly investigated and the proper action taken.” The organization stated it has no policy specifically requiring shredding—demonstrating that in the absence of written policies and procedures, employees often make mistakes that expose organizations to, at the very least, unwanted media scrutiny.

FULL ARTICLE

-Killeen Daily Herald March 22, 2011

HOSPITAL SUES SERVICE PROVIDER FOR LOST MATERIALS

February 24th, 2011

Source: myfoxny.com – February 11, 2011
 
The New York City’s municipal hospital system disclosed Friday that confidential medical records from four Bronx facilities were stolen last December 23rd when a van was left unlocked and unattended.
 
The hospital system has also begun providing data breach notification to 1.7 million people possibly affected by the data loss.
 
According to NAID CEO Bob Johnson, “Every company in the secure destruction industry should take note.  We have reached the point where one missing hard drive or one missing box could have similar consequences.  This is one of the reasons we are so focused on NAID AAA Certification’s unannounced audits in the field.”
 

Full Article

LAX COMPLIANCE COSTS FAR MORE THAN STRICT COMPLIANCE

February 8th, 2011

www.infosecurity-us.com

January 31, 2011- This brief article discusses the cost of noncompliance with data protection laws and regulations versus strict compliance. While businesses may balk at the cost of compliance, this study makes clear what NAID members are already tell their customers: it is cheaper to comply than to get caught improperly handling data.

 

“Companies are not investing enough in compliance with data protection regulations,” said Rekha Shenoy, vice president of strategy at Tripwire.

 

Full Article

 

NEW WRITTEN DESTRUCTION PROCEDURES REQUIREMENT PROPOSED IN MASSACHUSETTS LAW

January 31st, 2011

In Massachusetts, Representative William Straus’ bill (H 3427), pending in the state House of Representatives, sets forth a requirement for organizations to have written procedures for the disposal of personal information.
 
Specifically, the new law would require “Implementing and monitoring compliance with polices and procedures that require the burning, pulverizing or shredding of papers containing personal information so that the information cannot practicably by read or reconstructed; and Implementing and monitoring compliance with policies and procedures that require the destruction or erasure of electronic media and other non-paper media containing personal information so that the information cannot practicably by read or reconstructed.”
 
Readers in Massachusetts wishing to indicate their support for the proposed law should contact their state house representative via telephone, letter, or email.
 
It is important to note that contacting your representative is crucial to advancing the bill, however, out of district and out of state support can sometimes be detrimental to the bill’s passage. If you are a Massachusetts resident, please use this link to locate your representative.

MILTON, CARNEY HOSPITAL RECORDS FOUND AT DUMP IN GEORGETOWN

January 31st, 2011

Boston, Massachusetts – www.patriotledger.com
 
August 13, 2010- Thousands of records from four area hospitals were found at local dump, exposing sensitive patient data. Under Massachusetts law medical records must be disposed in a way that protects patient privacy, which courts have interpreted as shredding or burning. At press time there was no mention of an investigation or potential consequences—however, NAID will continue to follow this story in the future.
 
Full Article

PERSONAL HEALTH INFORMATION FOUND IN DUMPSTER

January 31st, 2011

April 26, 2010- The South Carolina Department of Health and Environmental Control issued a warning that as many as 1,800 residents may have had their personal information compromised by the Department’s failure to properly dispose of documents. The agency stated that it is making every attempt to notify affected individuals. Department policy is to shred the documents, and according to the agency the employee who failed to follow that policy has been terminated.

WOMAN GETS PRISON OVER IRVING TEACHERS ID THEFT

January 31st, 2011

www.statesmen.com – Austin , Texas
February 5, 2010- Sharon Denise Seeley from Bedford , Texas , was sentenced to 34 years in prison for stealing the identities of teachers and other school district employees. Ms. Seeley was sentenced to two years of prison for each count of identity theft, and claimed that the data came from a binder thrown in a trash bin. The binder contained the personal data of 3,200 district employees. Several teachers testified regarding the impact of Ms. Seeley’s actions, stating that the theft financially ruined them. In addition, the school district is compensating the victims for some of their loss.
 
Full Article

NEVADA DENTIST CITED FOR TOSSED RECORDS

December 2nd, 2009

Pahrump Valley Times – Pahrump , Nevada

November 4, 2009- Pahrump dentist Peter Doan was recently penalized by the Nevada Board of Dental Examiners for dumping confidential patient records in the desert. In addition to being placed on probation, Doan will have to attend classes on records management and pay nearly $2,000 in fines. Failure to meet any of the stipulations will result in the immediate suspension of Doan’s license to practice dentistry. Although Doan has been held accountable, as of press time he had not provided any explanation for his actions.

Full Article

Article Discusses Problem of Abandoned Records

November 18th, 2009

An article by Deborah Gage posted on the website of the San Francisco Chronicle on July 3rd discusses the issue of abandoned records and how proposed state legislation in California would provide some guidance and protection for organizations like property managers and records storage companies who find themselves left holding the records when the owner disappears.

The proposed law is the product of a workgroup formed by the state’s California Office of Privacy Protection. NAID participated in the workgroup, and one of the key issues NAID championed was that self storage operators no longer be allowed to auction off abandoned records to the highest bidder.  This is an inadvertent but common occurrence when self storage customers—who are often businesses—go under.

The legislation would make that practice illegal as well as requiring legacy custodians—those left with the abandoned record—to properly destroy them. If the proposed legislation passes, it is likely other states will follow California ’s lead.

Read the Full Article

Legal Files Left in Dumpster

November 18th, 2009

According to an article by Jessica Heffner posted to the website of the Middletown Journal  (Middletown, OH) on July 4th, piles of records containing personal information were casually discarded by a local law firm in a public garbage dumpster.  The article reports that the files contained Social Security numbers and other details that would make identity theft easy.

According to the Ohio Code of Professional Responsibility, attorneys are required to safeguard client property, including case records, during and after representation.

In the report the County Prosecutor comments that such practices are unacceptable but does not state whether or not further investigation or penalties will be pursued.

Read Full Article