ST. JOHNS COUNTY, Fla. — How did social security numbers, birthdates, and personal medical information end up on the side of the road in St. Johns County? That’s what a viewer who reached out to First Coast News wants to know.
Andrew, who asked we not use his last name, was driving on Race Track Road when he noticed papers scattered everywhere.
“Piece after piece after piece of the exact same thing,” Andrew said. “Truly insanity.”
He pulled up to the stoplight near Durbin Park Pavilion and stepped out of his car to take a closer look at what was blowing in the wind.
“There’s a prescription bag as part of it, and so I stepped out and just grabbed a handful,” Andrew said. “The first piece of paper I looked at had a person's name, their date of birth, social security number, address, the pharmacies information, the nursing home information, the medication they were prescribed, the doses they were prescribed, on one piece of paper.”
He called the St. Johns County Sheriff’s Office, but a spokesman tells First Coast News the deputy dispatched to the scene did not find anything. Days later, our On Your Side team found paper with personal information in the bushes across the street. It traces back to a luxury senior living community in Jacksonville.
“The pharmacy name on everything is Guardian pharmacy,” Andrew said. “I spoke with a pharmacist there and she confirmed that it's HarborChase in Mandarin. That was the assisted living facility that basically all this came from, from what they can tell.”
The On Your Side team reached out to HarborChase of Mandarin to ask how all of this sensitive information ended up on the side of the road. The administrator said the pharmacy notified them that documents had been found. Because they were discovered miles away from their facility, she said they were investigating their shredding company but declined to name it. The pharmacy said it had nothing to do with the documents being exposed.
“Something clearly went very, very wrong here because if the shredding company was properly handling the documents, this never could have happened,” Attorney Sean Cronin said. “The idea that these documents are flying down the road means, they were kept in some sort of unsecured container.”
Cronin said the release of federally protected patient health information without their consent, can carry hefty fines, up to $50,000 per occurrence.
“The facility is ultimately responsible for appropriate and proper disposal in the handling for these sensitive documents. They're entitled to federal protection under the HIPAA rules, the HIPAA privacy rules. If they do not provide that appropriate level of protection, they can have violations against them under federal law and be fined.”
In a statement to First Coast News, Dan Ellis, Corporate Director of Communications at Harbor Retirement Associates, said, “HarborChase contracts with a third-party vendor to dispose of materials containing sensitive resident and company data. All materials recovered were items that were disposed of through the proper procedure and sent out for destruction through the third-party vendor.”
We tried unsuccessfully to reach the families of numerous patients, some of whom recently died. HarborChase of Mandarin said it notified residents and families.
“If my loved one was in that facility, I would be checking their credit scores, and making sure no one is opening credit on their behalf or doing anything that you know, adverse that comes out of this.”
Andrew just hopes the information didn’t fall into the wrong hands because the information found scattered on the road is enough for an identity thief to do a lot of damage.
“My ultimate reaction was my good lord, somebody is about to be in a lot of trouble, that should not be spread along the side of the road,” Andrew said.
We reached out to the Agency for Health Care Administration, which oversees Florida's long-term care facilities. A spokeswoman told us they would look into it, but the agency said it had not received a complaint against HarborChase of Mandarin. If it did, it would conduct an onsite visit to ensure medical records were being properly secured.
“The fact that that this is just strewn amongst the weeds in the highway obviously is unacceptable,” Andrew said. “But the real question is, how did that get there? How is that not shredded? How is that not incinerated? How did that much personal information end up on the side of the road?”
The Health and Human Services Office for Civil Rights which investigates HIPPA violations told First Coast News it does not comment on open or potential investigations. When a breach of unsecured protected health information occurs under federal law, a HIPPA covered entity is required to notify individuals affected of the breach, which HarborChase of Mandarin said it did.
“The notification should include a brief description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches,” Rachel Seeger with HHS Office for Civil Rights said.
If you have a complaint against a licensed health care facility regulated by the Florida Agency for Health Care Administration, you can call 1-888-419-3456 / 800-955-8771 Florida Relay Service (TDD number) or use its Licensed Health Care Facility Complaint Form.
Federal HIPPA complaints can also be filed online.
In a statement to First Coast News, Dan Ellis, Corporate Director of Communications at Harbor Retirement Associates said:
“It has come to our attention that there was an incident involving the inadvertent disclosure of some personal information as it pertains to residents of our community. We are unaware of any actual misuse of personal information however we have provided notice to residents and families about the incident. Due to the nature of the data and the active investigation underway we are unable to discuss any specific details.
HarborChase contracts with a third-party vendor to dispose of materials containing sensitive resident and company data. All materials recovered were items that were disposed of through the proper procedure and sent out for destruction through the third-party vendor.
HarborChase believes strongly in a resident’s right to privacy and as such is working to determine how this incident occurred in order to prevent any further such incidents. Our Core Values speak to respect, attentiveness and integrity; HarborChase works diligently to maintain excellence particularly as it relates to privacy. Rest assured that HarborChase will never divulge or share a resident’s personal information without appropriate authority and will continue to properly dispose of any materials containing personal resident data so that no similar incidents occur in the future.”