Health files are sold as scrap paper to Utahn

Why Louis Mezzoni walked into Central Florida Regional Hospital in May 2006 is, frankly, none of your business.

His medical records — as are nearly all medical records in the U.S. — are private, guarded heavily by the Health Insurance Portability and Accountability Act.

When, at 77, Mezzoni died a few months after his visit to Central Florida Regional, his wife had trouble acquiring the records for billing purposes.

She was shocked when she found out they were sold last month at a Salt Lake surplus store for about $20.

"I find it inexcusable," said Susan Mezzoni, a nurse who lives in Lake Mary, Fla. "I don't like that they're out there."

Along with 27 others, Louis Mezzoni's records were unwittingly sold to a Salt Lake-area school teacher looking for a good deal on scrap paper for her fourth-grade class.

No charges are likely to follow, and officials chalked the incident up to a shipping problem. The people affected, however, want to know how it happened and, more importantly, how to make sure it doesn't happen again.

"I'm aghast," said Marcy Lippincott, a Lake Mary attorney whose father's records were among those that were lost. "I'm wondering who to sue. It's a complete invasion of privacy. It's appalling to think your records can be out there somewhere like that."

In December, the box was one of three shipped to a Las Vegas company for a Medicare audit, said Kelly Ferrell, the hospital's risk manager. Hospital officials had been tracking the box since it was reported missing in Phoenix but had not contacted the affected patients, she said.

"This stuff is very confidential," she said. "We worry about wrongful disclosure. That information is very personal."

The packages were certified and sent via UPS, Ferrell said. When one of the boxes did not arrive, a Las Vegas auditor on Feb. 4 contacted hospital officials who, in turn, contacted UPS two weeks later.

Officials said they were unsure how the box made its way to Utah, though the package containing the records also had a document indicating it was "overgoods" — a package that was sold because the shipping company could not deliver it or find its owner.

Shipping companies often sell off packages that cannot be delivered, but a UPS spokesman said his company keeps packages for at least three months before liquidating them.

"UPS has developed a very extensive and technologically advanced system for trying to identify and locate missing packages," Dan McMackin said. "And yes, we do inspect every shipment deemed to be overgoods. All sensitive shipments are treated with confidentiality and disposed of properly."

Still, the package containing the records slipped through and was eventually sold as scrap paper at National Product Sales, 1600 S. Empire Road. The teacher noticed the error before distributing the paper to students.

Hospital officials said they were waiting to hear back from UPS — "one to eight business days," Ferrell said — before alerting the affected patients, officials said.

Being warned early, however, is the only way people can start protecting themselves against fraud, said Kirk Torgensen, Utah's chief deputy attorney general.

The records from Central Florida Regional contained detailed medical histories, phone numbers, addresses, Social Security numbers and insurance information.

"If you get that into the wrong hands," Torgensen said, "it's a serious threat. No two ways about it."

Several of the patients whose information was lost in Salt Lake City are now deceased, and some relatives said they were not concerned about the missing box.