VA Mid-Atlantic Health Care Network (VISN 6)

Report ID: PSETS0000088087, U.S. Department of Veterans Affairs

Reported Entity: VISN 06 Fayetteville, NC

Issue:

On 04/17/13 during a routine walk through of the facility, the VA Chief of Police identified a recycle bin containing medical documentation and protected health information (PHI). The documentation was from the Optical Shop and included Veterans' names, social security numbers, dates of birth, addresses and phone numbers. The Police Chief spoke with an employee in the Optical shop who identified a black plastic trashcan marked FOR THE SHREDDER. The Police Chief contacted the Assistant Chief of EMS to collect the remaining documentation and place it in a shred bin as well as provide a Shred-It Container for the Optical Shop. The Assistant Chief of EMS also stated that it was not an EMS employee, but a Compensated Work Therapy (CWT) worker who had picked up the documents. The CWT worker should have placed the documents in the shred area, instead of the recycling area. The recyclable documents are picked up by the city and taken to a recycling plant. At this point it cannot be determined the exact number of Veterans affected or if any documents were picked up by the city, however a request has been made for the names of all patients seen since 01/11/13, as well as the schedule and pickup times. Update: 04/25/13: The scheduled pick up time for recycling is each Friday afternoon between 12:00 PM and 4:00 PM, so the documents could have been in the recycling bin for up to one week. This is not a secured area of the campus. To clarify, recycling and shredding services are separate at our facility. Items containing protected health information (PHI) should be shredded. In this case, they were recycled without being shredded. The documents are compacted, then emulsified at the recycling center. This process includes washing using a defoamer/emulsifier before being placed in a solution turning it into pulp. 05/01/13: The documents are in the recycling center no longer than one week from receipt of the PHI documents to being unidentifiable documents. The recycling truck picks up recycling at the medical center in large plastic bags and the same is repeated at each place on its route. At the end of the day, all items are taken to the recycling center warehouse, removed from the plastic bags and separated into their respective dumpster by county employees. VA recycled paper gets mixed with all other facilities' material along the route. When the dumpster is full, the dumpster is put on the back of a semi-tractor truck and taken to the Sonoco facility in Fayetteville. The paper is off-loaded directly onto a conveyor belt that bales the paper into huge bales and then strapped. The strapped bales are taken to a paper mill that un-straps the paper and places it directly into the emulsifying tank where it soaks and is broken down/digested into a liquid slurry to begin the paper making process. None of the documents can be recovered. Cumberland County provides their recycling containers, labor and transportation free of charge to our facility. There is not a contract. 05/08/13: There have been 3,527 patients identified as being seen in the Optical Shop since this started occurring. Not all of these would have had consult sheets put in the recycling area. The Privacy Officer will be contacting the service to determine how many of these would have had consults, and how many are duplicates, so they can determine the final number of unique Veterans potentially affected. 05/14/13: The national Data Breach Core Team has determined this is a HITECH Act reportable incident. The decision was based on the risk of having VA data at the County Recycling Center unsecured, with county employees going through the material to separate it. The consult records will need to be checked to see which of the 2,697 patients will need to be notified. This will require a press release and public posting to the Health and Human Services/Office of Civil Rights (HHS/OCR) web site. 05/15/13: There are a total of 1,147 Veterans that will be offered credit protection services. 05/31/13: After duplicates were removed 1,111 Veterans were involved. 06/12/13: The final count after further review is 1,094 Veterans.

Outcome:

NA