The state health department is contacting everyone whose personal information was compromised in a case of improperly discarded medical records The Nerve uncovered last month.
The S.C. Department of Health and Environmental Control also has tightened its internal controls on confidential identifying information as a result of the case, agency officials say.
In addition, a DHEC employee “who admitted throwing the documents away rather than taking them to be shredded” has been fired, according to a news release the department issued today.
The worker was fired March 15. “So far, no charges have been filed against the terminated employee,” the release says.
The actions by DHEC follow a State Law Enforcement Division investigation of the case, which involves several thousand DHEC medical records. The documents were found in a green roll cart designated for office paper at a recycling center behind the department’s headquarters, at 2600 Bull St. in Columbia.
The records list Social Security numbers, names, addresses, birthdates, phone numbers, yearly incomes levels and other personal data. Some of the forms also contain sensitive health information, such as the results of cancer screenings.
The records were sitting at the top of the roll cart. Anyone visiting the recycling center at the time they were there could have taken the documents. The site is an open access, public area that countless people use.
The improper disposal of the records exposed an unknown number of South Carolinians to the potential of identity theft and other threats.
Thom Berry, chief spokesman for DHEC, says he is not sure at this time how many people are being notified because the agency is still sorting through the records.
He says the fired employee, a male, knew he was not supposed to discard the records in the recycling bin. Berry was not sure who the worker was.
The wrongful discarding of the documents also ran afoul of state and federal laws designed to protect people from identity theft.
That’s why DHEC is contacting everyone whose confidential information was compromised. The laws require the agency to do so in the event of a breach of this magnitude.
The statutes also require DHEC to tell the federal government, the S.C. Department of Consumer Affairs and national credit reporting agencies about the breach. Fines could be involved under the state law.
The department also must issue a public notification of the breach, according to Berry.
The SLED probe began after The Nerve obtained the documents from a confidential source on Feb. 23 and returned them to the Department of Health and Environmental Control. DHEC then handed over the records to the State Law Enforcement Division and asked SLED to look into the matter.
Two SLED agents, Natalie Crosland and Bryan Jones, interviewed The Nerve as part of the inquiry. The agents also interviewed the source who provided the records to The Nerve.
The case made news across South Carolina.
After DHEC reacquired the records, agency personnel inspected the recycling bin, Berry says. “And we believe that we have everything that went into the trash.”
In an effort to avert future breaches, the Department of Health and Environmental Control has established new chain-of-custody protocols for confidential information, Berry says.
The agency has developed a new form for handling such data that requires signatures and supervisory involvement, he says.
“This was a case where longstanding agency procedures to protect personal information were not followed,” Commissioner Earl Hunter, DHEC’s top administrative official, says in the agency’s news release. “This is unacceptable for us and the public we serve. We are contacting each person whose information was on those documents to apologize.”
The Nerve will report more details about this case in the near future.
Reach Ward at (803) 779-5022, ext. 117, or eric@scpolicycouncil.com.