AMERICAN FORK — A blue recycling Dumpster sits about 20 steps back from State Street in American Fork, filled with medical records displaying patient names, Social Security numbers and more.

An investigation by KSL Newsradio over about a month's time found files were routinely left in the Dumpster, which was unlocked and unprotected, leaving the files accessible to anyone.

Photos of the Dumpster were shown to both state agencies and local hospitals. Al Tokunaga, University of Utah Hospital and Clinics director of health information, recognized some of their paperwork in the photos.

"Somebody needs to take action against that business or whoever did it to draw attention that it is a HIPAA (Health Insurance Portability and Accountability Act) violation and it does break patient confidentiality. It needs to be dealt with, I think, very severely. Those records should be disposed of properly."

X-ray film in the files contains silver particles that are sent to a recycling plant in Eureka where the silver is reclaimed. The medical files are supposed to be destroyed under contract.

Tokunaga said they spend a lot of money and take great steps to ensure patient privacy. All printed medical files used in the hospital are shredded before they leave the building. But sometimes files are sent out of the hospital for treatment purposes or for processing. Tokunaga said in these cases, strict contracts are signed outlining how the files have to be destroyed to protect privacy.

Assistant Utah Attorney General Richard Hamp also looked at the pictures of the Dumpster.

"In a word: alarmed. Here we have a business that seems to be totally oblivious to the problem of identity theft. Quite frankly, I'm sure any business owner would be alarmed if their names showed up in this trash Dumpster with their personal files there." His office sent an investigator to the site.

"I can say comfortably that we are dealing with thousands of people's medical records that have been compromised."

All of the hospitals contacted by KSL Newsradio launched their own investigations to see if HIPAA regulations have been violated. Hamp said leaving this type of information in a Dumpster could also violate a state civil law passed last year. "It makes it a violation civilly to fail to destroy personal information such as this in a way so that it's illegible either by shredding or burning or some way altering the information so it can't be read. The law provides for a penalty of up to $2,500 per individual up to $100,000 in total fines if there is a number of aggregate individuals affected."

No fines have been levied at this point as investigations are ongoing. Tokunaga said the U.'s hospitals and clinics are also in the process of switching from paper to digital records, which could help stop this problem from occurring in the future.

Hamp said the potential victims number in the thousands. The sorting company serves hospitals across the Intermountain West.

---

E-mail: rjeppsen@ksl.com