Recycled Medical Records Used As Scrap Paper At Elementary School

← Back to Stories (view on slashdot.org)

Recycled Medical Records Used As Scrap Paper At Elementary School

Posted by samzenpus on Monday November 21, 2011 @03:32AM from the it's-a-purple-duck-with-shot-records dept.

Parents with students at Hale Elementary School in Minneapolis have found something interesting on the back of their children's pictures hanging on the fridge, detailed medical information. From the article: "Jennifer Kane was tidying her dining room when she found the drawing by her daughter, Keely, who goes to Hale Elementary School. On the back of the paper was the name, birth date and detailed medical information for a 24-year-old St. Paul woman named Paula White. 'The more I read it, the more alarmed I became about the amount of information I had about this person,' said Kane." The security lapse has been blamed on a paralegal donating the paper to the school.

119 comments

First medical record post! by GameboyRMH · 2011-11-21 03:35 · Score: 5, Funny

Look in the source code of this comment for detailed medical records!

--
"When information is power, privacy is freedom" - Jah-Wren Ryel
1. Re:First medical record post! by AvitarX · 2011-11-21 03:57 · Score: 2
  
  I had a similar issue once.
  I was going through my parents' basement, and there were university info fill out things (SSN was still student ID at the time) that had my art on the other side.
  I was amused, as it was a pretty complete set of identity, and clearly from before it really mattered.
  
  --
  Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
HIPAA fail by akeeneye · 2011-11-21 03:36 · Score: 5, Interesting

There's got to be a massive fine coming for this.

--
The man who dies rich dies disgraced. -- Andrew Carnegie
1. Re:HIPAA fail by Alan+Shutko · 2011-11-21 03:46 · Score: 5, Informative
  
  Maybe not... The law firm is probably not a HIPAA covered agency. If the law firm got the records because their client was a covered entity, they might be in trouble under HIPAA. If they got the records because they were suing a covered entity, they probably aren't in trouble under HIPAA. They'd still be in trouble for disclosing private information, though.
  Here's a writeup.
2. Re:HIPAA fail by akeeneye · 2011-11-21 03:57 · Score: 1
  
  Curious: if the last situation that you mention is the case, who would they be in trouble *with* ?
  
  --
  The man who dies rich dies disgraced. -- Andrew Carnegie
3. Re:HIPAA fail by glrotate · 2011-11-21 04:09 · Score: -1
  
  They could be liable to the client for negligence.
  They could also get in trouble with the state bar and supreme court for violating the rules of professional responsibility.
4. Re:HIPAA fail by Talderas · 2011-11-21 04:26 · Score: 5, Informative
  
  There is no maybe about it. If the law firm is representing a covered entity then they have to comply with HIPAA regulations. This has been the case since February 17, 2010.
  You are also right on if the lawyer was not representing a covered entity. If they had acquired the information while representing a client bringing a lawsuit against a hospital then they aren't covered by HIPAA.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
5. Re:HIPAA fail by JSBiff · 2011-11-21 05:49 · Score: 2
  
  "You are also right on if the lawyer was not representing a covered entity. If they had acquired the information while representing a client bringing a lawsuit against a hospital then they aren't covered by HIPAA."
  That seems rather a giant loophole. You mean if I sue a medical center and get medical records, I can do whatever the heck I want with them? That doesn't seem like it could possibly be right.
  Wouldn't the court put you under some sort of non-disclosure order, if nothing else, if the court gives you access to private information you would not otherwise have?
6. Re:HIPAA fail by J'raxis · 2011-11-21 05:58 · Score: 1
  
  Probably just a lawsuit for negligence under one of the more broad and generic privacy laws?
  
  --
  Liberty in your lifetime
7. Re:HIPAA fail by Talderas · 2011-11-21 06:07 · Score: 5, Insightful
  
  You aren't going to be able to sue a medical center and get all medical records for all patients. It's unlikely that you would get any records other than your own health records.
  What happened here is a pretty clear chain of events as to how it happened.
  Here's the facts. Many (exact number unknown) pieces of scrap paper contained medical information. All that information originated from Sawicki and Phelps. Ms. White had hired them after she was in a car accident.
  The last fact heavily suggests that these attorneys are personal injury attorneys and possibly medical malpractice attorneys. They are going to need to have the medical records for their clients in order to build a case. This leads me to believe that all medical information disclosed by them were all clients of the law firm seeking restitution for injuries sustained.
  It's really not even a loophole at all. It's a possible consequence of giving your medical information to a group not covered by HIPAA.
  The only difference between this and giving your medical information to the guy that gets your Starbucks in the morning is that at least lawyers have the bar association and other organizations which may keep them in line regarding private information. That and a lawyer without clients because he keeps giving out their private info would be a lawyer without clients.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
8. Re:HIPAA fail by gstoddart · 2011-11-21 06:41 · Score: 4, Insightful
  
  Maybe not... The law firm is probably not a HIPAA covered agency.
  Really? That's somewhat appalling ... so the easiest way to sidestep these regulations is to give it to someone who isn't covered by them?
  I realize that's a gross simplification, but I should think that getting information covered under such a law would extend obligations to you. This information is covered under HIPAA ... you've been given this information ... therefore you have obligations under HIPAA.
  I mean, it's not like someone can give me Classified information and suddenly I'm free to do with it as I please.
  Sadly, I fear my version is probably more abstract and less likely to be that way in practice.
  
  --
  Lost at C:>. Found at C.
9. Re:HIPAA fail by Talderas · 2011-11-21 07:00 · Score: 4, Informative
  
  I don't think you understand the purpose of HIPAA.
  HIPAA is designed to dictate both how covered entities that can collect your PHI have to handle your PHI but mostly it's to cover the instances under which a covered entity can share your PHI with third parties without your permission with all other cases requiring your permission.
  There is no way for a covered entity (medical provider) to sidestep HIPAA by giving it to some 3rd party without first obtaining your permission. If they could give it without permission then the entity receiving the PHI is going to be covered under HIPAA as well either as a covered entity or a business associate.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
10. Re:HIPAA fail by gstoddart · 2011-11-21 07:08 · Score: 1
  
  I don't think you understand the purpose of HIPAA.
  Always in the realm of possibility.
  But, in the post I replied to:
  
  If they got the records because they were suing a covered entity, they probably aren't in trouble under HIPAA. They'd still be in trouble for disclosing private information, though.
  So, if the law firm got those records because of a legal action, that doesn't necessarily mean they got it with the patient's permission.
  To me, the obligation to treat the data as secure patient information can't possibly end at a law firm who was somehow involved with a medical provider.
  I just fail to see how the people leaking this information haven't breached the HIPAA requirements ... surely to hell giving someone's private medical information to a bunch of school children as scrap paper represents a gross violation of the purpose of HIPAA, which was to keep that data confidential and secured in the first place.
  I just don't get the magic "???" step two before "profit" that absolves people of responsibility to safeguard this data.
  
  --
  Lost at C:>. Found at C.
11. Re:HIPAA fail by Anonymous Coward · 2011-11-21 07:10 · Score: 0
  
  And key in that, I suppose (if it's the case) is that law firms are not required to be HIPAA compliant, and if you give your details to a firm that never was to begin with, HIPAA doesn't come into it at all.
12. Re:HIPAA fail by Talderas · 2011-11-21 08:02 · Score: 1
  
  A law firm cannot sue a covered entity for medical records. The law firm in question from the article is a personal injury firm. They, without a doubt, made a request to the hospital for the records. The hospital then contacted the firm's client seeking permission to release the PHI. The client gave permission to the hospital and they gave the records to the law firm.
  It's either that or the client directly received the PHI from the hospital and then gave them to the law firm.
  There are very few instances where a covered entity can give out PHI without a patient's permission. Mostly those are limited to compliance with other laws, like reporting potential child abuse.
  There was no violations of HIPAA in this incident, just idiotic behavior by the law firm. Now maybe this should serve as a reason for why law firms that take on personal injury or other medical related cases should be forced to follow HIPAA.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
13. Re:HIPAA fail by hairyfeet · 2011-11-21 11:33 · Score: 4, Interesting
  
  Hell the scary part for me is how many are supposed to be protecting those records don't even follow best practices! My mom was a popular charge nurse at a local hospital so i got to know the IT guy and his crew pretty decently. So a few years back he goes 'Hey you wanna have a ton of machines to strip? Back up the truck" and sure enough he loads 30 or so nice boxes onto my truck. Well i figure I'll get home and find the drives gone but nope, all still there with ALL THE DATA. i thought it was nice he trusted me but more than a little scary too.
  I'm also buddies with the apt super who is also the super at a bunch of office complexes in the area. he called me awhile back and said 'If you want a ton of boxes for parts get over here before the garbage man gets 'em" and sure enough the local teleco he supers for had put a mound of nice late P4s and early duals out for scrap. again when I get home with 'em and check ALL the drives are there and the CC data wasn't even encrypted!
  I used to be amazed at the stories of some megacorp losing tons of data but frankly I just can't be surprised anymore, it seems like nobody bothers to do even basic due diligence. When I was working corp I got permission to give our old machines to a shelter for abused women but before a single box left my shop I had DOD 7 wiped the drive and installed a clean disc image for the shelter with their programs. the thought of just letting a box go straight from the floor to the back of someone's truck, even someone i knew, would have gave me a heart attack!
  
  --
  ACs don't waste your time replying, your posts are never seen by me.
14. Re:HIPAA fail by BitterOak · 2011-11-21 14:57 · Score: 2
  
  Maybe not... The law firm is probably not a HIPAA covered agency.
  Which leads to an obvious question: why isn't everyone covered by HIPPA? Okay, not everyone would normally have medical records in their possession, and so they wouldn't run afoul of HIPPA, but why should anyone be able to disclose medical records to the public without permission of the patient? Seems like a rather giant loophole.
  
  --
  If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
15. Re:HIPAA fail by iamhassi · 2011-11-21 17:04 · Score: 2
  
  The only difference between this and giving your medical information to the guy that gets your Starbucks in the morning is that at least lawyers have the bar association and other organizations which may keep them in line regarding private information.
  Exactly. The story is a bit misleading because it leaves out the fact that either Ms. White picked up the information herself and brought it to the attorney's office or signed a document giving them full permission to obtain any medical records necessary for her personal injury case. Either way she gave them permission to have those records.
  
  However HIPAA still applies to attorneys. Just because she handed those records to the attorney doesn't mean he gets to show them to the world, in fact that's exactly what an attorney's *not* suppose to do. Even when I was a loan officer awhile back I had to sign HIPAA agreements because I could see medical bills on credit reports and apparently even knowing the Doctor's name and price of a procedure is covered under HIPAA.
  
  I wouldn't be surprised if the Bar Association got involved and suspended some licenses due to this gross breach of confidentiality.... or at least issued some stiff fines since this is an obvious breach to fine for and they're always looking for excuses to take a little extra $.
  
  --
  my karma will be here long after I'm gone
16. Re:HIPAA fail by Talderas · 2011-11-22 01:02 · Score: 3, Informative
  
  HIPAA only covers medical providers, health insurance plans, and medical clearinghouses (whatever those are). It is "extended" to cover business associates with which covered entities engage for work assuming the business associate has adequate protections to safeguard the PHI and they won't misuse it. The business associate label just allows a covered entity to share the PHI without seeking the patient's permission.
  A lawyer representing a hospital during a medical malpractice case would be considered a business associate. If a hospital wants to store backup tapes that contain PHI with Iron Mountain, then Iron Mountain is considered a business associate and must meet all the regulations of HIPAA.
  A lawyer representing a client who is suing a hospital for medical malpractice is not representing a covered entity and consequently not required to follow HIPAA regulations.
  If HIPAA was violated in this scenario then the hospital did so by releasing the records to the law firm but I highly doubt that the hospital released the records to the law firm without the patient's permission. The Bar Association or other entities may have something to say but a violation of HIPAA this is not.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
17. Re:HIPAA fail by Anonymous Coward · 2011-11-22 02:31 · Score: 0
  
  Actually, in every nondisclosure agreement I've had to sign, as long as you obtain the information without soliciting it you can publish it without breaking your agreement of confidentiality. Unless you're talking about government confidentiality. I don't know the story on that.
18. Re:HIPAA fail by [Zappo] · 2011-11-22 02:34 · Score: 1
  
  Isn't violation of attorney-client privilege kind of a big deal?
19. Re:HIPAA fail by iamhassi · 2011-11-23 13:01 · Score: 1
  
  That's nice, thanks for the links... oh wait, you didn't post any, but I did, to an attorney's website, where an attorney says something like this is a HIPAA violation.
  
  --
  my karma will be here long after I'm gone
20. Re:HIPAA fail by Talderas · 2011-11-28 01:32 · Score: 1
  
  And if you read your link, you would read the part about business associates having direct liability as of February 17, 2010. Your link validates all my statements, assuming you know what the lingo means.
  Business Associate: A business which provides a service on behalf of a covered entity that can be provided access to PHI without requiring a patient's permission.
  PHI: Personal Health Information
  Covered Entity: A business entity that is directly covered by HIPAA. These are medical practitioners, health care clearinghouse, or health plan.
  As I have stated numerous times in comments on this topic. This is most likely not a HIPAA violation. The lawfirm in question is a personal injury law firm. They were hired by the person whose PHI was released. The individual is not a covered entity under HIPAA thus anyone you hire to work for you is not a business associate. So there is no HIPAA violation unless the medical records were released to the law firm without the patient's permission.
  How about this for you as well.
  Let's say you hirer a law firm for a personal injury and you give them your medical information. This law firm also does work for a hospital in cases. If the law firm loses your PHI but not the PHI shared with it by the hospital, it's still not a HIPAA violation.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
HIPAA uber-violation by padraic2 · 2011-11-21 03:38 · Score: -1, Redundant

Someone should be fired immediately. And was there no one at the school that noticed this?
1. Re:HIPAA uber-violation by MyLongNickName · 2011-11-21 03:42 · Score: 5, Insightful
  
  I am sure the school carefully checked over the scrap paper being donated. Some teacher probably got a box full of paper, took a quick look and was just thankful her funding-starved school got some paper. Otherwise, she'd have had to buy some out of her own paycheck like many teachers do...
  
  --
  See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
2. Re:HIPAA uber-violation by sribe · 2011-11-21 03:44 · Score: 4, Informative
  
  Someone should be fired immediately. And was there no one at the school that noticed this?
  School teachers are not responsible for HIPAA compliance ;-)
3. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 03:57 · Score: 2, Interesting
  
  Yeah, but how else are you going to blame this on public employees? You just know it has to be their fault.
4. Re:HIPAA uber-violation by Crudely_Indecent · 2011-11-21 03:57 · Score: 0
  
  Haven't you heard? Literacy is a skill that's taught in college. Elementary and High School teachers don't teach it, so they aren't practicing it regularly. The grade school focus is more on tasks like diagnosing ADD.
  
  --
  
  "Lame" - Galaxar
5. Re:HIPAA uber-violation by crakbone · 2011-11-21 04:19 · Score: -1, Flamebait
  
  I'm sure her funding starved school used the paper fund on those brand new Ipads they like to give out.
6. Re:HIPAA uber-violation by supercrisp · 2011-11-21 04:29 · Score: 4, Interesting
  
  Yep. I'm a public university professor, and I regularly have to make copies on the back of once-used paper because we run out of money for paper. I've also been told I need to buy my own printer if I want access to a printer. I'm also being asked to pay for my own inter-library loan articles. Some of our faculty offices have holes in the wall large enough to stick your hand outside and check the weather. (I can't believe I'm not making that one up. But, yep, just looked out window to verify: Prof. Z's office has a fist-sized hole all the way thru the wall; the boards have just rotted away.) Money is getting tight. Unless it's for a new football stadium, which I can see from my window is coming along nicely. (Note to parents: DO NOT LET YOUR CHILDREN GET A GRADUATE DEGREE IN HISTORY, ENGLISH, GEOGRAPHY, OR ANY OF THE HUMANITIES!)
7. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 04:29 · Score: 1
  
  I am sure the school carefully checked over the scrap paper being donated. Some teacher probably got a box full of paper, took a quick look and was just thankful her funding-starved school got some paper. Otherwise, she'd have had to buy some out of her own paycheck like many teachers do...
  Someone at Larry Flynt publications should arrange for some "scrap paper" to be donated for the benefit of those poor undereducated students. More likely to get some from BoA though..
8. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 04:29 · Score: 2, Interesting
  
  A) If anyone violated HIPAA, it's the law office, not the school. And whether or not they're in violation of HIPAA specifically depends on how they came upon those records.
  B) The paralegal who donated the paper almost certainly will end up losing her job over this. Fortunately for you, we live in a society where people lose their jobs over honest mistakes, since something has to satisfy your misguided rage over something that had no effect on you whatsoever.
  C) TFA says this was an afterschool program. I don't know how your school worked, but at my school they didn't have a staff of people to inspect every material used by every afterschool program.
9. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 04:30 · Score: -1
  
  What planet do you live on?
10. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 04:38 · Score: 0
  
  All this, while at the same time tuition costs are breaking new record highs. Makes you wonder where all the money is going because it's certainly not being spent on the faculty.
11. Re:HIPAA uber-violation by 0100010001010011 · 2011-11-21 04:54 · Score: 1
  
  When working through problems for tests or even scratch paper for homework I'd always raid the recycle bin next to all the campus computers. Full of 1 sided paper that is just tossed.
  Sometimes you'll find a bunch of PS errors that printed nothing but glyphs on a 1/2 a ream of paper. Then it's the jackpot. I don't ever remember paying for paper during my undergraduate.
12. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 05:01 · Score: 0
  
  It goes to buy expensive furniture for the office of those that control the money: the administration in charge of receiving the tuition checks. Note for self: in the long term administration always transition from being an administration that take the administrative work off researchers hands into being an administration that enforce new administrative rules and controls the researchers did that administrative work correctly. Then they use their power of nuisance to funnel all the money to their administrative department.
13. Re:HIPAA uber-violation by Soluzar · 2011-11-21 05:06 · Score: 1
  
  Is it perhaps possible that "public" university means one of those insitutions which do NOT charge a fortune in tuition and instead offer a relatively low-cost alternative based on 'public' funding? I'm not an American so my knowledge is limited. Of course I'm also not sure if the GP is an American either, or if an American university is the one under discussion.
14. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 05:10 · Score: 1
  
  Damn greedy teachers with their gold-plated Celicas are too lazy vet their free paper for HIPAA violations. They should be supporting the economy by buying paper for their classroom out of their own damn pockets. And don't spew any socialism about the school board should be providing paper. Probably too busy plotting how to steal crumbs from the mouths of millionaires.
15. Re:HIPAA uber-violation by jank1887 · 2011-11-21 05:33 · Score: 2
  
  Probably somewhere that has color-less money. Our district gets 'tech funding'. We've bought a few advanced projectors on mobile cats, video cameras, and some other things (no iGear, sadly). But, our teachers get a 'paper allotment' and gott forbid if any other money was spent on paper. The PTA gives teachers a small allocation each year for 'supplementary items' for the classroom. We'd get audited if it was suspected the money was getting used for 'primary education', and that includes buying them new paper. When mentioning at a PTA meeting that maybe the group could act as the go-between to get 'scrap' from local businesses, this issue came up. Who would oversee the appropriateness of the 'scrap'. Which corporate side office would take on the extra work to ensure only approved scrap paper was released, etc. Some government offices would require a 'Distribution A - Approved for Public Release' on any paper that wasn't almost trivially devoid of info.
16. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 05:42 · Score: 1
  
  I have issue with A and B.
  
  If we have HIPAA in place to protect medical information it shouldn't matter the manner the party that released them came about it. If it was a lawsuit brought by a client of the firm or whatever, there should be no loophole what-so-ever for a violation like this.
  
  As for B the paralegal shouldn't be fired, their head was in the right place trying to help out a local school. Now IF this law firm was working on a case concerning these records at one time, then anyone who would possibly come into contact with the documents should have been made aware of any HIPAA regulations. I squarely place blame on the firm itself, not the person that released the documents.
  CAPTCHA: scoffed
17. Re:HIPAA uber-violation by J'raxis · 2011-11-21 06:00 · Score: 1
  
  Or to pay the salary of the newest assistant deputy backup vice superintendent...
  
  --
  Liberty in your lifetime
18. Re:HIPAA uber-violation by Tharsman · 2011-11-21 06:24 · Score: 1
  
  Someone should be fired immediately. And was there no one at the school that noticed this?
  Someone at the hospital should be fired immediately.
  I have experience handling medical data, and I have seen how aggressive HIPAA violations are pursued. The slightest mistake can result in fines that are so large that the parent company HAS closed down entire branches only due to some moron's mistake. And although I wont say names, I'm talking about one LARGE company with money to bribe senators and push laws. Yet they never get to avoid repercusions of HIPAA violations.
  The hospital in responsible for this is in big trouble. Paralegal excuses wont help them. An investigation would, for one, force the hospital to explain even why paralegals had access to PHI, in a record by record basis.
19. Re:HIPAA uber-violation by orgelspieler · 2011-11-21 06:26 · Score: 4, Funny
  
  We've bought a few advanced projectors on mobile cats...
  At my school we had mobile projector cats, too. It was hard to keep those little monsters still through an entire lecture, though. Especially when the teacher pulled out the laser pointer.
20. Re:HIPAA uber-violation by gd2shoe · 2011-11-21 07:02 · Score: 3, Insightful
  
  Oh bother. This is a law firm which deals with private information as a business. It's what they do. Every peon (non-lawyer) should always assume that every document is private, and that disclosure could lose them their jobs. They should be told this, but they should also be able to figure it out on their own.
  Now there are scenarios (ex:asking permission) where someone else would be at fault. In the general case, though, the paralegal is squarely at fault. I don't want to hire a lawyer who employs that paralegal... thus one can hardly blame the law firm for not wanting to employ him/her any further.
  
  --
  I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
21. Re:HIPAA uber-violation by Talderas · 2011-11-21 07:17 · Score: 1
  
  So.... you're ignoring that a person can give permission for non-covered entities to have access to that PHI. The sort of permission that would have to be granted to a law firm when they are pursuing a personal injury case for a client? The exact sort of law firm which is the subject of the article.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
22. Re:HIPAA uber-violation by Anonymous Coward · 2011-11-21 07:55 · Score: 0
  
  I'm surprised they didn't feed it to the kids.
23. Re:HIPAA uber-violation by supercrisp · 2011-11-21 08:11 · Score: 1
  
  United States public university professor, specifically a [state name] State University (2nd tier; first-tier research schools are University of [state name]). And whether or not public universities charge a fortune is a matter of perspective. Tuition at public universities has skyrocketed since the late 80s when the federal government began to reduce contributions. Then add the costs associated with computer technology needs and increased enrollment. Then add the diminished buying power of the dollar.... Tuition has increased every year. And, frankly, the quality of education has rapidly diminished as schools have been forced to teach a greater number of students with a greater range in ability/preparation. I just moved from an R1 school to this one; the budgets are bad at both, and at both most of the money was going into buildings, administrator salaries, and "development" (fundraising) staff and campaigns, while funding for the labs, libraries, faculty, and staff is slowly taken away.
24. Re:HIPAA uber-violation by OrigamiMarie · 2011-11-21 08:54 · Score: 1
  
  American here -- the problem is that while public universities certainly have lower tuition than private universities, you're still looking at fairly high tuition prices that are climbing every year (they usually have to get permission from the state legislature, which dithers a bit and then raises the cap).
  
  Add to this the fact that in order to get the good courses (and an actual degree), you have to be matriculated (officially enrolled in a degree-granting program), and in order to stay stay matriculated to you have to stay above a certain course load threshold, . . . and it means that people who are getting degrees mostly can't have full-time jobs at the same time. Most people don't have the stamina to have part-time jobs year-round while also taking enough courses. Which means the schools are requiring a rate of schooling that is inconsistent with staying out of debt.
  
  If OWS was a crowd that thought through cause-and-effect sorts of relationships, they might have pointed out that this is a major reason why students graduate with mountains of debt and degrees that can't pay it back.
25. Re:HIPAA uber-violation by Tharsman · 2011-11-21 10:30 · Score: 1
  
  Not ignored, if that is the case the hospital has to provide record of said permission. It's part of "explain even why paralegals had access to PHI."
26. Re:HIPAA uber-violation by lgw · 2011-11-21 11:07 · Score: 1
  
  "explain even why paralegals had access to PHI."
  Because the patient voluntarily released the information to her own law firm? They're personal injury lawyser representing her. The hospital did nothing wrong, and the law firm no more HIPAA-bound than a random guy you hand your medical records to. Not to say they won't be sued or censured for ordinary mishandling of client records.
  
  --
  Socialism: a lie told by totalitarians and believed by fools.
27. Re:HIPAA uber-violation by Trecares · 2011-11-21 11:32 · Score: 1
  
  That's the zoom-out feature. They're working on getting it to zoom-in.
28. Re:HIPAA uber-violation by DarwinSurvivor · 2011-11-21 19:30 · Score: 1
  
  There is a good chance that 99% of the paper was just random scribblings and memos and there just happened to be 1 or 2 sheets of sensitive stuff.
D'oh! by GameboyRMH · 2011-11-21 03:38 · Score: -1, Offtopic

Sorry, I failed to outsmart Slashdot's HTML filter :-(

--
"When information is power, privacy is freedom" - Jah-Wren Ryel
1. Re:D'oh! by Anonymous Coward · 2011-11-21 03:49 · Score: 0, Troll
  
  WAH! I'm stupid! I'm stupid! I'm stupider than you! I'm stupider than you in every way!
2. Re:D'oh! by sexconker · 2011-11-21 05:33 · Score: 2
  
  WAH! I'm stupid! I'm stupid! I'm stupider than you! I'm stupider than you in every way!
  Your lyrics lack subtlety. You can't just have your characters announce how they feel! That makes me feel angry!
3. Re:D'oh! by Anonymous Coward · 2011-11-21 06:48 · Score: 0, Offtopic
  
  
  
  Just recycle your HTML to get it past /.'s HTML filter.
First Post? by Anonymous Coward · 2011-11-21 03:39 · Score: -1

LOL
I can see it now... by Moheeheeko · 2011-11-21 03:40 · Score: 4, Funny

"Mommy, whats 'anal hemorrhoids'?"
1. Re:I can see it now... by Anonymous Coward · 2011-11-21 03:42 · Score: 5, Funny
  
  "Mommy, whats 'anal hemorrhoids'?"
  A much better condition than 'oral hemorrhoids'.
2. Re:I can see it now... by Anonymous Coward · 2011-11-21 03:48 · Score: -1
  
  Also known as a 'GOP debate'.
3. Re:I can see it now... by rubycodez · 2011-11-21 04:06 · Score: -1, Flamebait
  
  it's also what democrats get for sucking on the very same plutocrat dicks the republicans fellate
4. Re:I can see it now... by martas · 2011-11-21 04:40 · Score: 1
  
  We all know about 6 degrees of Kevin Bacon. Introducing: 3 degrees of politics. "Any topic can be connected to petty squabbling about politics in 3 statements".
  
  --
  weinersmith
5. Re:I can see it now... by Anonymous Coward · 2011-11-21 05:33 · Score: 0
  
  "Mommy, why has that man a bottle up there?"
6. Re:I can see it now... by Anonymous Coward · 2011-11-21 05:34 · Score: 0
  
  Private enterprise could do it in two.
7. Re:I can see it now... by sexconker · 2011-11-21 05:40 · Score: 1
  
  We all know about 6 degrees of Kevin Bacon. Introducing: 3 degrees of politics. "Any topic can be connected to petty squabbling about politics in 3 statements".
  6 Kevins?
  My home town nearly went to zero Kevins back in 1978.
  It was a particularly cold winter, and we were already down to 3 Kevins (due to their low popularity at the time).
  Kevin Thomas had flown out to be with his son's family for a wedding and got stuck in Boston for a whole week due to the weather. 2 Kevins left.
  Kevin Lemmer was rushed to the hospital during my shift. I still remember the call from the EMTs as the ambulance was rushing toward us. "It's Lemmer. He's in bad shape. Drove right into the fucking ditch." We called the time of death at 6:15 PM.
  At 6:16, all eyes turned to room 2217. Kevin Spencer was 82 and on his death bed with leukemia. His family being Catholic, he had already been given his last writes. If he couldn't hold out until Kevin Thomas returned, we would be at zero Kevins. Sure, we had 4 perfectly healthy Calvins, but they're just not the same.
  It was 7:15 when Carla Brooks and her husband James burst through the main entrance. "She's not due for 2 weeks!", James exclaimed. As the staff bustled around getting the Brookses settled, they exchanged darting glances with each other. This was their first child, and they wanted to keep the baby's sex a secret. Of course, in a small town, secrets don't get kept. Nearly all of the hospital staff new that the child about to rip open Mrs. Brooks was indeed a boy.
  The delivery was routine, and Kevin Brooks was born healthy, if a tad underweight, at 10:52 PM. Kevin Spencer was pronounced dead at 10:54.
  It was, as they say, a close one. Kevin Thomas arrived two days later, the weather having finally cleared up. To this day, we still rib him about it.
  Cedar Falls is currently at 5 Kevins.
8. Re:I can see it now... by Anonymous Coward · 2011-11-21 06:05 · Score: 0
  
  "Mommy, why is that hamster up there?"
Hip, Hip, Hipaa! by Anonymous Coward · 2011-11-21 03:40 · Score: 0

Good going! Would HIPPA be violated, or lawyer client privileged be violated in this case?
1. Re:Hip, Hip, Hipaa! by sribe · 2011-11-21 03:45 · Score: 3, Interesting
  
  Good going! Would HIPPA be violated, or lawyer client privileged be violated in this case?
  Probably both, ouch...
2. Re:Hip, Hip, Hipaa! by rubycodez · 2011-11-21 04:07 · Score: 1
  
  No HIPPA violation, law firms aren't healthcare providers nor reimbursers, and neither are schools
3. Re:Hip, Hip, Hipaa! by Anonymous Coward · 2011-11-21 04:32 · Score: 0
  
  HIPAA violation. But probably not of the law firm (although there's plenty of other regulations they violated).
  The HIPAA violatoin is at the hospital that provided these documents. Under HIPAA they ar e not allowed to share any private patient information with entities that are not following HIPAA regulations themselves.
Paralegal? by MyLongNickName · 2011-11-21 03:41 · Score: 2

A paralegal donated the paper? Wow. That is like a sys admin posting a server password on a post-it note on the server rack...

--
See my journal for slashdot ID's by year. Mine created in 2005. http://slashdot.org/journal/289875/slashdot-ids-by-year
1. Re:Paralegal? by ae1294 · 2011-11-21 03:55 · Score: 2
  
  A paralegal donated the paper? Wow. That is like a sys admin posting a server password on a post-it note on the server rack...
  What's wrong with a post-it note? How do you think I'm browsing the Internet bro?
2. Re:Paralegal? by Anonymous Coward · 2011-11-21 04:06 · Score: 0
  
  ...in the building of its competitors, to be more correct.
3. Re:Paralegal? by Anonymous Coward · 2011-11-21 04:12 · Score: 1
  
  A paralegal donated the paper? Wow. That is like a sys admin posting a server password on a post-it note on the server rack...
  No, it's like the intern that re-images the compromised computers taking all the password laden Post-It notes from all the monitors in the company and donating them to an area school.
4. Re:Paralegal? by virgnarus · 2011-11-21 04:18 · Score: 1
  
  I practice security through obscurity: my post-it note sits on the KVM.
5. Re:Paralegal? by Stargoat · 2011-11-21 04:20 · Score: 4, Insightful
  
  I can tell you exactly what happened. There were two boxes next to the copier, one which was for the "special needs" children in school, and the other for materials to be shredded. Someone dumped some papers with PII into the "special need" children box when they should have gone into the shred box. Then, more documents without PII were dumped into the "special need" children box. When the school came calling for paper as they do once a month, the paralegal grabbed the "special need" children box and gave it to the school, giving the documents a cursory glance.
  More than likely, the arrogant lawyer who will just dump his papers wherever because he's too busy to actually pay attention is the culprit. The poor paralegal will get the shaft, the "special need" children box will get removed, and we will all move on feeling wiser - except the "special need" children, who no longer will get paper either with or without PII.
  
  --
  Hoist Number One and Number Six.
6. Re:Paralegal? by Dunbal · 2011-11-21 04:40 · Score: 1
  
  Nothing wrong with a post it note. Putting it in view of the web-cam, however...
  
  --
  Seven puppies were harmed during the making of this post.
Hospitals are getting better at privacy by Anonymous Coward · 2011-11-21 03:41 · Score: 0

Unfortunately medical information is passed to so many 3rd parties (including overseas) that ensuring privacy is now becoming an impossibility.
1. Re:Hospitals are getting better at privacy by SJHillman · 2011-11-21 04:01 · Score: 4, Funny
  
  But now it's passed to 3rd parties AND 3rd graders!
2. Re:Hospitals are getting better at privacy by Anonymous Coward · 2011-11-21 04:50 · Score: 0
  
  now it's passed to 3rd parties AND 3rd graders
  Finally we're catching up with China!
paralegal did not use a paper shredder by Joe_Dragon · 2011-11-21 03:41 · Score: 1

Wow just wow did the boss not give her the time to do it But why do they not have a locked bin to drop papers in that a out side place like iron mountain or others to destroy the paper?
HIPPA lolz by Anonymous Coward · 2011-11-21 03:42 · Score: 1

But but.. what about HIPPA? it would garentee nothing like this ever happens! .. oh.. what's that... just because someone makes a huge compliance law doesn't prevent basic slip-ups like this?
1. Re:HIPPA lolz by rubycodez · 2011-11-21 04:08 · Score: 1
  
  HIPPA is irrelevant, doesn't apply to anyone even remotely connected to this incident
2. Re:HIPPA lolz by Talderas · 2011-11-21 04:24 · Score: 1
  
  Lawyers who represent covered entities have had to be in compliance with HIPAA regulations since February 17, 2010. They are classified as a business associate of the covered entity and must take steps to protect the information.
  
  --
  "Lack of speed can be overcome. In the worst case by patience." --Znork
3. Re:HIPPA lolz by cdrguru · 2011-11-21 04:40 · Score: 1
  
  HIPPA basically means that the medical staff has to get a form signed that says it is OK for them to release your information, thereby giving them a pass as to whatever happens from then on. I am sure that everyone is in compliance with getting the proper forms signed allowing release of information to anyone. You misunderstand if you think HIPPA is about keeping medical information out of the hands of others - it is all about having the proper forms signed allowing medical information to be given out. Once they have the forms, it is all OK.
  Of course the paralegal will get fired for this slipup. They were probably trying to do something constructive for the school - but did it with the wrong paper. In some ways, I cannot imagine what the "right" paper from a law firm might be.
4. Re:HIPPA lolz by microcars · 2011-11-21 06:23 · Score: 1
  
  parent is correct: "HIPPA" does not apply to anyone connected with this incident.
  
  --
  I like microcars
5. Re:HIPPA lolz by Anonymous Coward · 2011-11-21 07:24 · Score: 0
  
  Let me clear it up - HIPAA also denotes WHO the information is given out to, at least in most cases. Some cases state that the info will be given out "as needed", but most companies (ours) the person does specifies who is allowed to receive this info.
Penalties by Anonymous Coward · 2011-11-21 03:42 · Score: 1

Looks like the Hippa laws has 3 tiers of penalties depending on intent of disclosure. The first penalty, $50K fine and possible jail sentence of not more than a year, is for a person knowingly disclosing the information but with no malicious intent. So the people guilty of this law would be the paralegal, Ms. Kane, and possibly the CBS reporter. The medical facility that the paralegal works at probably shares in the blame too. So how many people here will be prosecuted? Probably none.
Of course I don't want to see Ms. Kane or the reporter punished; it's a poorly written law. There are so many poorly written laws (such as copyright laws) where people are punished harshly. Shouldn't these people be pursued with equal vigor?
1. Re:Penalties by sribe · 2011-11-21 03:47 · Score: 2
  
  So the people guilty of this law would be the paralegal, Ms. Kane, and possibly the CBS reporter.
  No, you're missing the part of HIPAA that spells out who is covered by the regulation. Neither the teacher nor the reporter are bound by HIPAA.
Management needs to be punished by gweihir · 2011-11-21 03:44 · Score: 2

Responsibility for processes that ensure this does not happen is with management. If it happens, then not the paralegal, but his/her manager screwed up and needs to be punished. With power comes responsibility. It is time for the to be reflected in the legal system.

--
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
1. Re:Management needs to be punished by Stormthirst · 2011-11-21 03:48 · Score: 2
  
  That will never happen. I know that's what's supposed to happen - but we all know that management will never take any responsibility for anything. They will just pass the buck to some poor para legal who is being paid barely minimum wage every single time.
2. Re:Management needs to be punished by AdrianKemp · 2011-11-21 03:56 · Score: 2
  
  Well now hang on...
  Phelps said the donation was a violation of the firmâ(TM)s privacy policies.
  âoeIt was a mistake,â said Phelps. âoeThe employee did not believe there was any personal information on the papers.â
  It doesn't sound like the manager was in any way involved in this. It sounds very much to me like the paralegal just took some paper over to the school.
  Managers need to be crucified when there is a lapse in policy or reasonable management of staff. But one employee doing something wrong with full knowledge of policy and without clearing it through management first is no reason to send blame up the chain.
3. Re:Management needs to be punished by sgt+scrub · 2011-11-21 04:32 · Score: 1
  
  I worked as a paralegal while in college. I'll have you know they get paid minimum wage + tips.
  
  --
  Having to work for a living is the root of all evil.
4. Re:Management needs to be punished by Anonymous Coward · 2011-11-21 04:50 · Score: 0
  
  So how did the employee get hold of the papers? If they were in some kind of protected area for safe disposal of private documents that was clearly labelled as shred only then that's different to if they were just in a box on the desk next to the non-private documents that just go in the regular recycling. In one of these situations the manager is responsible, in the other, arguably not (depending on the training the employee received). We can't say either way without knowing the full facts of course, but equally we can't rule it out.
5. Re:Management needs to be punished by gstoddart · 2011-11-21 04:57 · Score: 2
  
  I worked as a paralegal while in college. I'll have you know they get paid minimum wage + tips.
  By which you mean they get to, um, service the senior partner's needs in order to retain their position?
  Sorry, I'm sure that is libelous and suggests that lawyers are a bunch of miserable, manipulative pricks. That part is merely an opinion and should be stated as such. ;-)
  
  --
  Lost at C:>. Found at C.
6. Re:Management needs to be punished by gmhowell · 2011-11-21 16:55 · Score: 2
  
  Sorry, I'm sure that is libelous and suggests that lawyers are a bunch of miserable, manipulative pricks. That part is merely an opinion and should be stated as such. ;-)
  What did a bunch of miserable, manipulative pricks ever do to you to imply they are lawyers?
  
  --
  Jesus was all right but his disciples were thick and ordinary. -John Lennon
Sue the law firm. by 140Mandak262Jamuna · 2011-11-21 03:45 · Score: 1

Well, it is once in a lifetime chance. The law firm is negligent, is violating privacy law HEPA or whatever. Ambulance chaser in the cross-hairs. Sue that law firm for everything it got.

--
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
1. Re:Sue the law firm. by Anonymous Coward · 2011-11-21 03:54 · Score: 0
  
  Yes this law firm has release far to much dust! Sue Sue Sue
epic fail by Anonymous Coward · 2011-11-21 03:45 · Score: 0

How dumb do you have to be before donating legal documents (without first checking with your boss) to a school seems like a good idea... these clowns will be lucky if HIPPA fines are the worst that come from this.
Wake up everyone! by Anonymous Coward · 2011-11-21 03:48 · Score: 0

The government needs to wake up and realize this entire industry isn't spending any money on security.
High Efficiency Particle Arresting by Anonymous Coward · 2011-11-21 04:04 · Score: 0

violating privacy law HEPA or whatever
Yes! That law firm really needs better privacy filters! Something has to happen to clear the air!
I got some once by Anonymous Coward · 2011-11-21 04:08 · Score: 0

I once got an Ebay item where the packing material was from a mental health practice. It turns out the secretary there used the scrap for packing. Anyways, I sent them an e-mail, got an e-mail back from a lawyer asking if I could send him the documents. I did, and then I got an e-mail saying it was taken care of, and I was contacted by the person or anything, to let them know.
Makes Sense by Waffle+Iron · 2011-11-21 04:09 · Score: 4, Funny

Three decades ago when I was in high school, they loaded our PDP-8's line printer with the the back sides of boring inventory reports from some manufacturing company.
However, now that we don't manufacturer anything in the USA any more, and our entire economy is becoming nothing more than a mix of healthcare providers and consumers, they *have* to use old health records for printer paper in schools. There's nothing else to use.
1. Re:Makes Sense by Anonymous Coward · 2011-11-21 04:31 · Score: 1
  
  If our technology allows our society to survive with fewer and fewer manufacturing jobs, because of technology, shouldn't we try to make a new social model in which people don't need to work so much to get the same things? It's happened before, why can't it happen again?
2. Re:Makes Sense by Beorytis · 2011-11-21 04:33 · Score: 1
  
  You got modded Funny; I wish it was... To the healthcare industry, personal records are really nothing more than "boring inventory reports".
3. Re:Makes Sense by TheGratefulNet · 2011-11-21 04:46 · Score: 1
  
  I have at least 3 boxes of old, unused green-bar. will that help?
  /oblig 'goml'
  
  --
  
  --
  "It is now safe to switch off your computer."
4. Re:Makes Sense by GrumpySteen · 2011-11-21 05:22 · Score: 1
  
  > they *have* to use old health records for printer paper in schools. There's nothing else to use.
  It's a crazy idea, but I think they could probably buy printer paper and use that.
5. Re:Makes Sense by jank1887 · 2011-11-21 05:43 · Score: 1
  
  only if the perforated feed strips are still there. those make the greatest crafts for the kindergartners.
6. Re:Makes Sense by Anonymous Coward · 2011-11-21 07:13 · Score: 0
  
  It's a crazy idea, but I think they could probably buy printer paper and use that.
  With what money do you suggest they buy paper with? At the rate they are slashing the budgets, books and desks will be a thing of the past here soon.
7. Re:Makes Sense by Anonymous Coward · 2011-11-21 09:02 · Score: 0
  
  That sounds like communist talk to me!
hysteria about health record security by rubycodez · 2011-11-21 04:13 · Score: 0

amusing the hysteria and fear about health records being randomly revealed, no one in a city far away cares about your case of crotch rot. It's no big deal. really.
1. Re:hysteria about health record security by Jason+Levine · 2011-11-21 06:54 · Score: 3, Insightful
  
  Health records can contain personally identifying information (like SSN/DOB/address) which can be used for ID theft. (As an ID theft victim, trust me when I say this is *NOT* fun to clean up after.) Also, potentially embarrassing information could be revealed that was trusted to remain between doctor and patient. Working in IT in a medical organization, I can attest to the power HIPAA has over our actions. We need to keep it in mind with everything we do. People get fired for violations like looking up someone's records that they didn't have a job-related need to do. It's not a warning not to do it again with repeat offenders getting the boot. It's strike one and you're out. There will be an investigation and people will be fired.
  
  --
  My sci-fi novel, Ghost Thief, is now available from Amazon.com.
2. Re:hysteria about health record security by rubycodez · 2011-11-21 07:59 · Score: 2
  
  As ID theft victim, I can tell you SS number is only icing on cake, not necessary at all. The DOB and address are trivially obtained, and of course credit card companies send "identity theft kits" whereby any misdelivered mail might give a thief a "check" to steal your money. I've also had a person 800 miles away put medical charges on my insurance account, somehow they had obtained insurance card (misdelivered mail again?) and used in conjunction with their own real ID. So then I get bill with their name on it, thousands of dollars of surgery and services were rendered with no questions asked.
That is Horrible by sgt+scrub · 2011-11-21 04:28 · Score: 1

Now the kids will see how bad you get f***d when you go to the doctor and will avoid getting proper medical care!

--
Having to work for a living is the root of all evil.
Improverished schools by Anonymous Coward · 2011-11-21 04:35 · Score: 0

If the teachers get tired of spending their own money to buy paper for the school, this type of thing will happen. Most school's don't have enough money for printer paper for the whole year. Some schools run out of money for that by mid September
1. Re:Improverished schools by jank1887 · 2011-11-21 05:48 · Score: 1
  
  In addition, teachers are being forced to print/copy more, because they have to 'teach to the test' for all of the NCLB state assessments. there are many other ways to assess learning, but they need recorded documentation, and need to repeat delivery of assessment exercises in the exact form of the big test. (standard test taking practice, been tutoring it for SATs, etc. for years). When you have a predetermined metric, you design to the metric, and in this case that means using more paper.
Nothing Will Happen by NicknamesAreStupid · 2011-11-21 05:11 · Score: 1

This will get swept under the rug. The lawyers will say that a box of paper records is nothing compared to this -- Sutter Health laptop stolen with unencrypted records of 4 million patients. The defense of saying "but I didn't do nearly as badly as the other idiot" actually works (just ask Stalin about his Hitler excuse). Seriously, the medical industry has worked for decades to make it immune from legal liability, and their efforts have been very effective.
Ask a Printing Company by Anonymous Coward · 2011-11-21 05:32 · Score: 0

If schools in the USA are so starved for paper, I'd urge them to stop by their local print and copy shop. They have loads of scrap paper, often with nothing on the back (trimmed off a small job) or with just business marketing print job stuff on the back.
I worked at a print shop and they daily toss stacks and stacks of blank trimmings into the recycle bin. Often a small job printed on 8.5/11 inch paper so it's not exactly proper size, but great for arts and crafts.
FedEx commercial by qeorqe · 2011-11-21 10:17 · Score: 1

This seems similar to a FedEx commercial.
spoiler (rot13):
Na bssvpr vf erhfvat gur onpxf bs hfrq cncre. Fbzrbar gura nfxf "'Jung'f gur Rkrphgvir pbzcrafngvba yvfg?"