Unsuspecting person stumbles across poor medical records management

Bobby Roberts of Athens, Alabama, was surprised to find what was contained in the delinquent self-storage facility he recently acquired. Instead of medical equipment and old office files, Roberts said the boxes within the unit contained confidential health records, according to the Times Daily newspaper.

In an example of poor medical records management, Roberts said the files contained the Social Security numbers, addresses, phone numbers, insurance information and driver’s license numbers of patients. Many dated back to 2002, but others were as recent as 2009, he told the newspaper.

Roberts said he won the delinquent storage units from Climate Guard Self Storage in an auction.

“Each unit had its door up with three pieces of caution tape up over [the entrance]. We couldn’t go in, we could just look," Roberts said of the bidding process.

Roberts said he had no idea his bid of $1,000 would get him personal health information.

According to the newspaper, the files once belonged to a local healthcare organization that performed ultrasounds and other tests on patients. The provider would acquire the health records when patients' primary-care physicians referred them for the tests.

The healthcare provider shut down in 2009, and apparently many of its medical records were forgotten about, former vice president Steve Vickery told the Times Daily. The company had become overrun with paper records and rented the storage unit to free up space at its Florence, Alabama, location.

"We rented a unit because we started getting too many [records] there at the [Russellville] office, so we had to have a backup storage facility," he said. "[The acting president] was in charge of everything as far as paying our bills. Obviously, he didn’t pay for this storage facility."

Whether bills are paid or not, it's important to note that self-storage units should never be used for a medical records management strategy. Instead, experts encourage healthcare providers to utilize the services of a professional records management company.

That way, experts say, there is no question as to whether personally identifiable health information is stored properly in compliance with the U.S. Health Information Portability and Accountability Act. Also, shredding services can be used to destroy the documents when they are no longer needed or, as was the case in Alabama, a company goes out of business.