Faulty Record Disposal By Business Associate Exposes Physician Practice

July 27, 2015 – In The News
Part B News

Elizabeth G. Litten and Michael J. Kline were featured in the Part B News article, "Faulty Record Disposal By Business Associate Exposes Physician Practice." Full text can be found in the July 27, 2015, issue, but a synopsis is noted below.

FileFax Inc., a Chicago-area record storage and disposal company, is being sued by the Illinois attorney general's office for improper disposal and exposure of thousands of patient medical records, which belonged to Suburban Lung Associates, a pulmonology group. Suburban Lung Associates had hired FileFax to dispose of the medical documents.

Instead of properly disposing of the medical documents, FileFax dumped the records into an unlocked, public garbage dumpster. The documents that were placed in the dumpster contained records for about 1,500 patients and included information such as Social Security numbers, names and phone numbers, among other information.

According to Elizabeth G. Litten, an attorney at Fox Rothschild LLP, many companies outsource the storage as well as disposal of records to a third party.

"Even if the practice was perfect and a victim, it's still a hassle [to deal with the breach]," says Litten.

Taking that into consideration, if any patients do choose to file any lawsuits against FileFax, Suburban Lung Associates also would be named as an additional defendant. "It's their records and their name. They'll have to give attention to the litigation [even if the practice has done no wrong]," warns attorney Michael Kline, also with Fox Rothschild.

Litten goes on to explain that even with the spike in electronic medical documents, the paper records are not immune to breaches.

Plus, disposal cases garner a lot of media attention. "Reporters love to dumpster dive. It's more sexy [than some other HIPAA violations]," says Kline. "It's a horror show for the covered entity. And if there's no business associate agreement, it's even worse," he adds.