Updated law provides more protection for abandoned medical records

Back to TopCommentsE-mailPrintBookmark and Share

Patients who go to the doctor’s office looking for relief from a chronic condition or a cure for a sudden ailment typically turn over a trove of personal medical and financial details before they even get into the exam room. And when they depart, they leave all that information with the physician.

focus-abandoned-11-15col.jpg Medical equipment and records from shuttered My Fast Lab in Crown Point, including copies of Social Security numbers and drivers’ licenses, were found in a trash bin behind a restaurant in June 2015. The attorney general’s office now has possession of them. (Photo courtesy of Times of Northwest Indiana)

Medical professionals and facilities are required by the Health Insurance Portability and Accountability Act to protect the confidentiality of patient records. Recently, stepped-up enforcement of the federal regulation has brought hefty fines for violations by health care providers, but for files that are abandoned, left unsecured and potentially accessible to non-medical personnel, state law is providing the protection.

Indiana already had a statute covering abandoned medical records, but Senate Enrolled Act 549, which sailed through the Statehouse during the 2017 session, updated the law. The new provisions expanded the definition of “abandoned,” added language requiring database owners to safeguard the medical information stored in their systems, and gave the Indiana Attorney General the power to recover the costs of protecting the discarded health records.

Attorneys view the new law as a response to the increasing use of electronic medical records. Paper files are becoming obsolete as doctors, nurses and medical technicians put patient history into computers and tablets. Keeping these files updated, accessible and safe is very complex and very costly.

Krieg DeVault LLP partner Stephanie Eckerle and senior associate Meghan Linvill McNab said the new law is addressing the intricacies of securing electronic medical records and reminding physicians they need to keep careful watch over their files by, among other things, implementing HIPAA-compliant security practices. The update to the state statute is not necessarily an indication that health care providers are neglecting their responsibilities.

Eckerle Eckerle

“I don’t think we’re seeing a laxness in confidentiality,” Eckerle said. “I think most health care providers are trying to comply with the regulations.”

Still, when medical practices become defunct, all the records are left behind. The Indiana Attorney General’s website includes a link that lists the physicians and facilities that abandoned their medical files and provides instructions for how patients can retrieve their information. Currently, the list has 18 entries.

News stories in the past couple of years also have recounted medical records being found in the trash. In the summer of 2015, an employee of a pizza parlor in northwest Indiana peered into a dumpster behind the restaurant and found equipment and patient files from medical testing facility My Fast Lab. The documents included lab results as well as photocopies of Social Security cards, driver’s licenses and insurance policy numbers.

Seng Seng

That’s the most valuable kind of information, said South Bend attorney Laura Seng, chair of Barnes & Thornburg LLP’s national health care department. Thieves do not necessarily care about a patient’s kidney stone, but with bank account numbers and a home address, they can steal the individual’s identity. Also, with the insurance information, they could get their own medical treatment and then file the claim on the other person’s health plan.

Preventive measure

SEA 549 was inspired by paper medical records being discovered in a city park.

Indianapolis Republican Sen. Jack Sandlin, co-author of the measure, decided to introduce the legislation after meeting with the consumer protection division in the Indiana Attorney General’s Office in 2016.

The state lawyers told the senator about the work they had to do to catalogue and preserve the patients’ personal health files that had been thrown into a recycling bin at Broad Ripple Park in Indianapolis last summer. Police officers discovered the documents, pulled them from the bin and handed them over to the attorney general’s office.

The original version of SEA 549 enlarged the definition of “abandoned” to include medical records that are “recklessly or negligently treated.” Also, it gave the attorney general the ability to file an action against a health care provider to recover the costs of safeguarding the abandoned records.

When the bill reached the floor of the House of Representatives, Republican Rep. Mike Speedy of Indianapolis successfully offered an amendment he described as narrowing the scope of the bill. Some legislators who worried that the original bill was too broad liked Speedy’s language limiting the measure to health care providers and clarifying the definition of health records.

Freeman Freeman

Sandlin’s co-author, Sen. Aaron Freeman, R-Indianapolis, described SEA 549 as being a preventive measure. He does not want the law to be punitive in nature but rather to encourage medical professionals to have a plan on how to protect patient files.

“We need to button up people’s private information where we can, especially their private medical information,” Freeman said. “When companies do go out of business, they need to make sure these records are secure.”

And the advent of electronic medical records is making the data more accessible. As attorney Patrick Cross, leader of Faegre Baker Daniels LLP’s national health and life science industry team, pointed out, the electronic platform creates efficiency by allowing health care professionals to access a patient’s entire history of illness, treatment and medications without having to rely on the individual’s memory.

Increasingly, through health information exchanges and the like, medical professionals can get an even more complete picture of an individual’s health history by pulling information from most or even all the doctors a patient has seen.

focus-abandoned-4-15col.jpg (Photo courtesy of Times of Northwest Indiana)

“We want to provide broader access and availability to the health care providers who need the information to provide higher-quality treatment to the patient,” Cross said. But he noted these files still have to be protected from unauthorized individuals and that is a “problem in the process that needs to be managed.”

SEA 549 gives the attorney general additional enforcement authority to hold current and former health care providers accountable if they fail to safeguard medical records and databases.

Deterrent and reminder

Indiana’s SEA 549 comes as the U.S. Department of Health and Human Services has imposed hefty fines for HIPAA violations.

In May, St. Luke’s-Roosevelt Hospital Center Inc. in New York City paid $387,200 after one of its offices faxed a patient’s medical records, which included information on his HIV status, sexual orientation, medical care and mental health diagnosis, to the patient’s employer. Memorial Hermann Health System in Texas was fined $2.4 million the same month for disclosing a patient’s personal health information in a press release.

McNab McNab

Indiana’s abandoned medical records law covers the area that HIPAA does not. When Sandlin presented the bill to the Senate Civil Law Committee, members questioned whether the measure would conflict or duplicate HIPAA. He explained when a health care entity goes out of business and walks away from its patients’ records, the federal act does not supply a remedy.

State statute did provide some funding for the attorney general to maintain the abandoned records, but safeguarding electronic files is more expensive. Securing the information and preventing hackers from gaining entry require special expertise that usually comes with a high price tag.

The new law adds a section that allows the attorney general to file an action against a current or former health care provider to recover the costs of storing and protecting the abandoned medical records. A court may then order reimbursement if the judge finds the provider “intentionally or negligently abandoned” the records.

Although recovering money from a defunct practice might be difficult, in some circumstances the attorney general could recoup its costs. Eckerle and McNab said the provision is more a deterrent, letting providers know they could be handed a bill if they abandon their records.•


Post a comment to this story

We reserve the right to remove any post that we feel is obscene, profane, vulgar, racist, sexually explicit, abusive, or hateful.
You are legally responsible for what you post and your anonymity is not guaranteed.
Posts that insult, defame, threaten, harass or abuse other readers or people mentioned in Indiana Lawyer editorial content are also subject to removal. Please respect the privacy of individuals and refrain from posting personal information.
No solicitations, spamming or advertisements are allowed. Readers may post links to other informational websites that are relevant to the topic at hand, but please do not link to objectionable material.
We may remove messages that are unrelated to the topic, encourage illegal activity, use all capital letters or are unreadable.

Messages that are flagged by readers as objectionable will be reviewed and may or may not be removed. Please do not flag a post simply because you disagree with it.

Sponsored by
Subscribe to Indiana Lawyer
  1. He TIL team,please zap this comment too since it was merely marking a scammer and not reflecting on the story. Thanks, happy Monday, keep up the fine work.

  2. You just need my social security number sent to your Gmail account to process then loan, right? Beware scammers indeed.

  3. The appellate court just said doctors can be sued for reporting child abuse. The most dangerous form of child abuse with the highest mortality rate of any form of child abuse (between 6% and 9% according to the below listed studies). Now doctors will be far less likely to report this form of dangerous child abuse in Indiana. If you want to know what this is, google the names Lacey Spears, Julie Conley (and look at what happened when uninformed judges returned that child against medical advice), Hope Ybarra, and Dixie Blanchard. Here is some really good reporting on what this allegation was: Here are the two research papers: 25% of sibling are dead in that second study. 25%!!! Unbelievable ruling. Chilling. Wrong.

  4. Mr. Levin says that the BMV engaged in misconduct--that the BMV (or, rather, someone in the BMV) knew Indiana motorists were being overcharged fees but did nothing to correct the situation. Such misconduct, whether engaged in by one individual or by a group, is called theft (defined as knowingly or intentionally exerting unauthorized control over the property of another person with the intent to deprive the other person of the property's value or use). Theft is a crime in Indiana (as it still is in most of the civilized world). One wonders, then, why there have been no criminal prosecutions of BMV officials for this theft? Government misconduct doesn't occur in a vacuum. An individual who works for or oversees a government agency is responsible for the misconduct. In this instance, somebody (or somebodies) with the BMV, at some time, knew Indiana motorists were being overcharged. What's more, this person (or these people), even after having the error of their ways pointed out to them, did nothing to fix the problem. Instead, the overcharges continued. Thus, the taxpayers of Indiana are also on the hook for the millions of dollars in attorneys fees (for both sides; the BMV didn't see fit to avail itself of the services of a lawyer employed by the state government) that had to be spent in order to finally convince the BMV that stealing money from Indiana motorists was a bad thing. Given that the BMV official(s) responsible for this crime continued their misconduct, covered it up, and never did anything until the agency reached an agreeable settlement, it seems the statute of limitations for prosecuting these folks has not yet run. I hope our Attorney General is paying attention to this fiasco and is seriously considering prosecution. Indiana, the state that works . . . for thieves.

  5. I'm glad that attorney Carl Hayes, who represented the BMV in this case, is able to say that his client "is pleased to have resolved the issue". Everyone makes mistakes, even bureaucratic behemoths like Indiana's BMV. So to some extent we need to be forgiving of such mistakes. But when those mistakes are going to cost Indiana taxpayers millions of dollars to rectify (because neither plaintiff's counsel nor Mr. Hayes gave freely of their services, and the BMV, being a state-funded agency, relies on taxpayer dollars to pay these attorneys their fees), the agency doesn't have a right to feel "pleased to have resolved the issue". One is left wondering why the BMV feels so pleased with this resolution? The magnitude of the agency's overcharges might suggest to some that, perhaps, these errors were more than mere oversight. Could this be why the agency is so "pleased" with this resolution? Will Indiana motorists ever be assured that the culture of incompetence (if not worse) that the BMV seems to have fostered is no longer the status quo? Or will even more "overcharges" and lawsuits result? It's fairly obvious who is really "pleased to have resolved the issue", and it's not Indiana's taxpayers who are on the hook for the legal fees generated in these cases.