KANSAS CITY, Mo. - The dumping of hundreds of patient records into an open-topped dumpster on a windy Monday could lead to millions of dollars in fines for Research Medical Center and Midwest Women’s Healthcare Specialists for violations of federal patient privacy laws.
The records, which were scattered for blocks by winds on Monday, contain patient names, social security numbers, addresses and procedures and tests performed. Those recovered by a good Samaritan and given to 41 Action News run mainly from August to September in 2011.
All the patients are women, ranging in age from 17 to 87 years old.
“At Midwest Women's Healthcare we take patient privacy very seriously,” a spokesperson emailed 41 Action News on Tuesday afternoon. "We continue to thoroughly investigate this issue and will take appropriate action based on our findings. Midwest Women’s Healthcare is in the process of determining which patients may have been affected and intends to notify them as soon as possible.”
On Tuesday, local attorneys said the hospital could be held liable for violating so-called HIPAA laws, developed in the late 1990s to protect patient privacy. Fines for exposing medical information can run up to $50,000 per instance, leaving Research or other potentially culpable entities on the hook for millions of dollars.
Violations could include disposing of the documents without notifying patients, doing so improperly or incompletely, and failing to recover the records after they blew away, attorneys familiar with the law’s implications say.
Civil cases could also follow.
Attorney Maureen Brady of McShane & Brady LLC already has one case pending against Research Medical for an instance in which a hospital employee is accused of handing over medical records to someone unauthorized to receive them.
“They potentially would be looking at millions of dollars in fines from the federal government, and now they also can be prosecuted in state court,” Brady said of the incident on Monday.
“Research certainly has to lock them, lock themselves down,” Brady said in an interview at her office on Tuesday. “They need to follow the rules that have been imposed on them by federal law, and Missouri law to protect their patient's privacy.”
Since Monday afternoon, 41 Action News contacted several women whose records were recovered to inform them of the breach and offer to return the records. Each expressed varying degrees of anger at the medical staffs which let them down.
“You put a lot of time and research into where you're going to deliver your baby,” one woman said. “I never thought that this part would be something I would have to worry about.”