Inside TDV - The Data Vault Blog
Not Just Document Shredding; Secure Document Shredding
From Gwinnett County, Georgia, comes the latest reason for every organization to have a secure document shredding solution: A crew of county inmates collecting trash on a busy Gwinnett County road discovered thousands of medical documents scattered everywhere.
According to WSB-TV in Atlanta, the paper records came from Eastside Medical Center in Snellville and were on their way with a vendor to be shredded.
Why the documents never arrived isn’t clear, but it underscores one key point: Document shredding services aren’t always secure document shredding services. Hey, you can buy a shredder for a couple hundred dollars and open a shredding service in your garage. You stick the private medical documents into the shredder and – poof! – just like that, they’re confetti.
But then what? And who is responsible if they aren’t shredded properly, or if some documents don’t get shredded at all? Who is accountable?
Clearly, the unnamed vendor associated with this story doesn’t represent a secure document shredding service. I’d call this one shoddy at best, and at worst absolutely irresponsible.
“Patients’ names, address, phone numbers, the type of surgery they had, type of medication they were on,” one witness was quoted as saying. “Whoever was driving had to see all these documents in the rear view mirror or side view mirror just all over the place.”
Did they? Did they just not bother to stop? If so, that’s a problem. Laws are in place with strict regulations covering private information, from human resources and trade secrets to customer information and medical records. Every organization – not just a hospital, as in this story – must be aware of this and select a vendor that complies with these regulations.
Sensitive documents such as those abandoned in Gwinnett County should be securely transported to a shredding facility, shredded, reduced to pulp and recycled. Hey, and that way you even help the environment while protecting private information.
The last line of the story reads, “Duluth Police say they investigated and found no criminal wrongdoing and have classified the incident as an accident.”
I bet HIPAA officials may have something more to say about that.