Like your privacy? Of course. We all do. What about your medical records? If you are a Tennessee resident, it seems as though there has been a minor mix-up as — a wrong fax number involved. Can you say a violation of HIPPA laws? Here’s the lowdown from The Tennessean…
Tennessee gave doctors wrong fax number in privacy breach
Patients’ private medical records faxed out of state
By Chris Echegaray
THE TENNESSEAN
The Tennessee Department of Human Services said it accidentally sent the wrong fax number to 100 medical providers across the state, leading them to erroneously send sensitive patient information to an Indiana businessman.
“We’re extremely embarrassed, and we’re working to remedy the situation,” said Michelle Mowery Johnson, spokeswoman for DHS. “We hope it doesn’t happen again.”
The state sent an e-mail blast to 29,000 medical providers with the correct toll-free fax information on Monday.
The problem was first reported by The Tennessean.
Bill Keith, owner of SunRise Solar Inc. in Indiana, has been receiving hundreds of confidential medical faxes from doctors’ offices and other medical providers in Tennessee for three years.
Keith was, on Monday, still receiving patient information meant for the Tennessee Department of Human Services in Nashville. Keith has tried to correct the problem with the state and doctors’ offices but to no avail.
On Friday, state officials blamed doctors’ offices, saying that the toll-free fax numbers for Keith’s business and the state nearly match. But Monday, Mowery Johnson said the state was taking some responsibility for the problem, which stemmed from a typing error.
It was a new caseworker in the Disability Determination Section, under DHS, who sent a cover sheet with the wrong fax number to medical providers, Mowery Johnson said. Also, the state can’t change the fax number because it belongs to the Social Security Administration, which handles the disability checks, Mowery Johnson said. Changing the fax number would affect thousands of people, state officials said.
Keith said the state suggested that he change his fax number but he can’t because he fears it would negatively affect his business.
“People in Tennessee ought to be concerned, and there will probably be a public outcry,” Keith said. “This shows the inefficiencies in our system. Doctors’ office have been rude to me on this issue when I try to point out the problem.”
E-records would help
To reduce the risk of private medical information faxed to the wrong place, medical providers should switch to electronic record keeping, said Mark Frisse, director of regional informatics at the Vanderbilt Center for Better Health.
This would leave an electronic footprint, making medical staff accountable for the information they are sending or receiving, Frisse said. It’s more perilous, he said, to have paperwork floating around.
“It’s a sloppy world with faxes and paper,” he said. “People by far pay more attention to the electronic than in the fax world.”
Most Tennessee medical providers have electronic records but 4,500 of them still use the fax machine, Mowery Johnson said.
Problems aren’t rare
Confidential medical information sent to the wrong place is not uncommon.
Just this summer, Louis Hoyt, a Nashville businessman, received at least seven faxes from a Birmingham, Ala., lab meant for doctors’ offices here.
Hoyt, co-founder of Berkeley Tandem Inc. in Nashville, realized the faxes were not meant for him. He called the Birmingham lab in July to let people there know he had received faxes for patients. Hoyt discarded the information and said the lab promised to rectify the problem.
“I wouldn’t be happy if I were the patient,” Hoyt said. “It’s an honest mistake, nothing malicious. I wonder how many times this happens with the volume of medical info that’s out there.”
In East Tennessee, Pat Gutshall has received hundreds of faxed pages of medical history accidentally sent by doctors’ offices to her son’s auto dealership, Victory Motors, in Johnson City.
Gutshall’s fax machine is routinely tied up with hundreds of pages, including 20 to 30 pages on one patient. Gutshall called hospitals and doctors’ offices to let them know about the mishap. Still, the faxes intended for state labs kept rolling into the auto shop.
Privacy laws questioned
Debi Buttram says medical privacy laws are useless.
Buttram moved to Murfreesboro from Indiana after experiencing a security breach at a hospital several years ago. A staff worker was able to access her records and disseminated the information.
Buttram told the hospital to seal her medical record and never release it to anyone. She tested the hospital by faxing a generic note without a Social Security number and signature, stating to release her records. The hospital faxed them right over, she said.
“There is no way to protect yourself,” Buttram said. “People need to be aware of what is going on with our records. The HIPAA laws are useless.”
Patients who have had their medical records disseminated can file a complaint under HIPAA, the federal Health Insurance Portability and Accountability Act. Each doctor’s office has a medical privacy officer, and patients may file HIPAA complaints with those officers.
Also, patients can file a complaint with the U.S. Department of Health and Human Services, Office of Civil Rights, at www.hhs.gov/ocr/hipaa.
John Scofield's News Blog 