VA Southeast Network (VISN 7)

Report ID: SPE000000058518, U.S. Department of Veterans Affairs

Reported Entity: VISN 07 Augusta, GA

Issue:

A clerk at the Aiken Community Based Outpatient Clinic (CBOC) disposed of sensitive information in the regular trash. The trash was emptied into the dumpster. The dumpster company picked up trash. Update: 02/18/11: A Business Manager at the Aiken CBOC called the Information Security Officer (ISO) to report that one of the clerks discarded a stack of appointment lists in the regular trash on 02/16/11. The incident was discovered the morning of 02/17/11, when another clerk noticed a piece of paper with her handwriting on it hanging from the dumpster. She retrieved the piece of paper and discovered that it was an appointment list. The dumpster had already been emptied by the trash company on 02/16/11. The appointment lists contain the full name of the patient, full SSN, telephone number, CBOC name, doctors name, means test, co-pay, team patient is assigned to, appointment date and time. At this point there is no way to determine how many patients are involved. The incident is being investigated. 02/22/11: The employee who discarded the documents was not on duty 02/18/11. The trash company verified that they picked up the trash from the CBOC on the afternoon of 02/16/11. No one from the CBOC has been to the dump site. During the Data Breach Core Team (DBCT) meeting, the DBCT determined that the DBCT does not have the authority to require the facility to send someone to the landfill to attempt to retrieve the documents. The facility may use its own discretion to decide to send someone to attempt to retrieve the documents based on criteria such as the size of the landfill, its location, the number of days since the documents were taken to the landfill, etc., provided they use proper equipment and appropriate precautions. 03/02/11: The employee was interviewed on 02/25/11 and stated that most of the documents were outdated information pamphlets. The remaining documents potentially contained information on patients who were treated within the last 6 months. The PO is working to identify the final number in order to determine the total number of promotional codes needed for notification/credit monitoring. 03/08/11: The Data Breach Core Team (DBCT) determined that Veterans will receive credit protection services based on the information that may have been exposed, 2,667 Veterans will receive a letter offering credit protection services and 50 letters of Next of Kin notification since their full SSN was exposed. 04/06/11: A conference call was held at 10:00am with the Associate. Director of the Charlie Norwood VAMC outlining the next steps to notify the Veterans and the press. The PO will mailed out the letters to the Veterans today and provide information to the press on Friday, April 8, 2011. IRT Director will notify VACO executive management after receiving email from the Ass. Director that the letters has been mailed. 04/06/11: The Associate. Director states Mr. Hartmann per our discussion today, our Privacy Officer has delivered the notification letters to the Postal Office main branch. IRT Director will let the OPA at VACO know ... they will be in contact with you regarding the press release. IRT Director requested Jo Schuda to work with the facility regarding the press release.

Outcome:

Employee removed from assigned duty and case referred to HR for disciplinary action. Clinic staff, employees, and volunteers required to complete Privacy Training. Measures taken to reduce the use of printed documents with PHI/PII in the clinic. Information Bulletin on Disposal of VA Sensitive Information drafted and sent to all staff. Bulletin posted on the Medial Center's intranet for reference. Information deemed as unrecoverable and undiscoverable by the landfill company.