As Howard Bennett stood over his portable office shredder and pushed the “start” button, he felt confident that he was doing everything within his power to both protect the confidential information of his client and protect his busy south Florida insurance office from privacy law compliance violations.  After all, he reasoned, experts have touted the benefits of paper shredding and document destruction as identity theft deterrents for years.  As he slowly fed the paper into the machine and looked into the collection bin beneath, he was surprised to notice that several papers passed through the shredder virtually unscathed, requiring him to run these documents through a second time.  It was also evident to Howard that the shreds of paper left behind still contained readable confidential information such as his client’s bank account numbers, Social Security numbers, addresses, and birth dates.  In other words, the careful shredding procedure which had been a source of pride a few moments ago now filled Howard with dread.  He had been using this type of shredder in his office for years – how many other documents, he asked himself, had been “destroyed” so ineffectively by this machine?

The above example illustrates perfectly the misconceptions that many Fort Lauderdale and Broward County businesses have about paper shredding.  Although it is true that document shredding and destruction are considered favored methods of keeping identity thieves at bay, great care must be taken by businesses to ensure that these processes are completed and successful.  Although it is true that portable office shredders are ideal for most home and residential use, they are usually found to be insufficient when dealing with large volumes of paper.  As Howard discovered, paper must be fed into these small machines a few sheets at a time – usually no more than ten.  The average file box contains approximately 2,500 pieces of paper – which translates into a lot of time and money spent for someone to stand over the machine and insert the documents.  Another disadvantage to this type of machine is the large strips of shredded paper that it may leave behind.  Clever identity thieves and “dumpster divers” have become very sophisticated and are perfectly capable of piecing together these large strips – a process which is similar to that of putting together a jigsaw puzzle.  All of these problems usually add up to only once conclusion – the use of a portable shredder is probably not the best solution for local businesses that want to safeguard the sensitive data of their customers and avoid litigation and heavy penalties for violating privacy compliance regulations.

Copyright secured by Digiprove © 2012]]> http://recordshred.com/shredding/professional-shredding-vs-portable-office-shredders/feed/ 0 http://recordshred.com/identity-theft-2/medical-identity-theft-in-miami/ http://recordshred.com/identity-theft-2/medical-identity-theft-in-miami/#comments Tue, 21 Feb 2012 10:49:30 +0000 RecordSHRED Blog http://recordshred.com/?p=2630

It is with certainty that I can say that most residents living in the Miami and Dade County area have heard about the problem of identity theft.  Media coverage that includes warnings and steps that can be taken to prevent one of these crimes abound, and even highly publicized personalities such as Tiger Woods, Robert Deniro, Oprah Winfrey, Steven Spielberg, and Ted Turner can count themselves among the millions of identity theft victims in this country.  A fact of which many south Florida citizens are probably unaware is that Florida leads the country in states with identity theft incidents per capita, according to information obtained from the United States Federal Trade Commission.  Authorities are of the opinion that this is primarily due to not only a rise in identity theft cases, but also to the emergence of an even more sinister relative – that of medical identity theft.

Medical Identity Theft in Miami

The main difference between medical identity theft and its more famous cousin lies in not how the information is obtained, but how it is used.  “Dumpster diving” and other methods of thievery are used to gain unauthorized access to medical data, just as they are used by standard identity thieves to gain access to financial information and bank accounts.  However, medical identity thieves are not interested in breaching a bank account or opening up a bogus credit account in someone else’s name – they are focused on using the stolen health information to gain access to prescription medication, surgery, or medical treatment.  Medical identity thieves may also use this information to file fraudulent bills to insurance companies.  In short, medical identity theft can take its toll on not only financial health, but also physical health.

One of the stumbling blocks that authorities have found in combating medical identity theft is that, similar to an incident of standard identity theft, it may take quite some time for any wrongdoing to be discovered – sometimes as much as years.  By the time the damage is uncovered, the medical identity thief has actually changed the victim’s medical history – perhaps obliterating an existing health problem or adding a health condition that does not apply to the victim – such as a recent case where the identity of a cancer patient was stolen, and by the time it was discovered, her record contained no evidence of her cancer, but contained so many prescriptions for a narcotic substance that she was actually suspected by law enforcement of drug trafficking.

Medical patients and health care offices in the Miami and Dade County are that want to protect them are advised that the best way to accomplish this is by retaining the services of a professional medical records shredding company such as recordSHRED.  recordSHRED has been serving the records destruction needs of the south Florida medical community since 2003, and the company has earned an excellent reputation for quality, service, and competitive pricing.  Mobile shredding is available, as is off site shredding in the company’s access restricted facility located in Fort Lauderdale.  For more information regarding shredding and medical identity theft, please call (305)229-0102 or visit http://recordshred.com/business-shredding/medical-shredding/.

Copyright secured by Digiprove © 2012]]> http://recordshred.com/identity-theft-2/medical-identity-theft-in-miami/feed/ 0 http://recordshred.com/privacy_laws_shredding/hipaa-overview-part-3/ http://recordshred.com/privacy_laws_shredding/hipaa-overview-part-3/#comments Mon, 20 Feb 2012 10:35:55 +0000 RecordSHRED Blog http://recordshred.com/?p=2543

The acronym HIPAA, which stands for the Health insurance Portability and Accountability Act of 1996, is one of the most important federal laws which has been passed with the goal of protecting patients from unscrupulous insurance practices such as raising premiums of denying coverage based on preexisting conditions and also to allow employees to retain health care coverage if they lose their jobs.  However, the most common association that most people make with HIPAA concerns safeguarding the privacy of patient clinical data and personal information.  As referenced in Part 2 of this article, a HIPAA covered entity is forbidden to disclose patient information for any purpose other than for treatment, payment, or health care operations without either the authorization of the patient or under an exception in the HIPAA regulations.  We now turn our attention to the many ways that HIPAA can be violated as well as to the penalties for these situations in an attempt to demonstrate the important of HIPAA compliance to businesses in the Miami and Dade County area.

The short version, according to the Department of Health and Human Services Office of Civil Rights (OCR), is that any HIPAA covered entity (which includes basically any office that handles patient medical and/or personal data) that fails to comply with HIPAA policies and procedures can be penalized civilly or criminally.  However, as is the case with most other federal laws, there are several degrees of non-compliance under the proverbial HIPAA umbrella.

a) Unknown violations – Those who do not adhere to HIPAA policies and procedures can be fined or prosecuted regardless of whether or not they were knowingly in violation. The minimum penalty for a HIPAA violation where the individual did not know that he or she violated HIPAA is $100 per violation. The annual maximum for the minimum penalty amount is $25,000 for repeat violations.

b) Willful neglect – In cases of willful neglect, such as when employee carelessly disposes of medical records or leaves his or her password in plain sight, has the potential to cost the medical office a minimum of $10,000 per violation, with the annual maximum for such offenses approximately $250,000.

c) Reasonable cause – This type of violations lies somewhere between the unknown and willful neglect variety, and occurs when the breach happened knowingly, but was not a result of willful neglect.   The minimum civil penalty is $1,000 per violation with an annual maximum of $100,000 for additional violations.

d) Criminal conduct – Anyone who knowingly discloses confidential health information can be charged criminally and imprisoned for up to one year with a fine of up to $50,000. If the violation was committed under false pretenses, individuals can face up to five years in prison and a fine of up to $100,000.

The most effective way that many south Florida medical offices have found to protect themselves and their employees from the threat of HIPAA violations is to retain the services of a professional medical records shredding company such as recordSHRED.  recordSHRED has been serving the medical data destruction needs of the Miami and Dade County area since 2003, and has earned many kudos for its mobile shredding and off-site shredding services as well as its competitive pricing and convenience.  For more information, please call (305)229-0102 or visit http://recordshred.com/business-shredding/medical-shredding/.

It should come as no surprise that the sheer number of federal privacy laws that have been enacted during the past fifteen years has left many businesses confused.  A steady stream of unfamiliar acronyms paired with a variety of provisions, amendments, and revisions….it is little wonder that many Miami and Dade County companies, even those who regularly schedule medical records destruction and medical data shredding, are concerned about issues of privacy and compliance.  I have attempted to address these questions by providing overviews of the most prevalent of these laws during this article series.  I concluded my discussion last week on the many facets of HIPAA (Health Insurance Portability and Accountability Act).  I now turn my attention to the law known by many as the “enforcer” for HIPAA, known as HITECH (Health Information Technology for Economic and Clinical Health Act).

First, a brief history lesson:  HITECH was enacted as part of the American Recovery and Reinvestment Act of 2009 in an effort to promote the adoption and “meaningful use” of health information technology – most specifically when applied to the use of EMRs (electronic medical records).  The HITECH Act defines “meaningful use” as having three main components:  (a) the use of a certified EMR in a meaningful manner; (b) the use of certified EMR technology for electronic exchange of health information to improve quality of health care; and (c) the use of certified EMR technology to submit clinical quality and other measures.  A medical provider can only demonstrate “meaningful use” if they are using EMR technology in ways that can be measured significantly in quality and in quantity.

Although HITECH can be considered the so-called “new kid on the block” compared to HIPAA, which has been around since 1996, many of HITECH’s provisions simply provide strength for provisions already put into place by HIPAA.  For example, HIPAA does not require covered entities to report and/or notify individuals or government agencies of any unauthorized access to personal health information. By contrast, Section 13402 of the HITECH Act requires covered entities (as defined by HIPAA – see Parts 1 and 2 of my article series on HIPAA) to notify individuals in the event of a breach of unsecured protected health information.  In addition, Section 13407 of HITECH establishes breach notification requirements for vendors who work with personal health records and related entities that are not subject to the HIPAA requirements. Although HITECH expects this notification process to occur without delay, it sets a time limit for this process – which must be completed within sixty (60) days of the breach.  It is also worth noting that HITECH defines the term “breach” as the “unauthorized acquisition, access, use or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information.”

I found this quote recently on the quotesea.com website while perusing the internet for some relevant news about identity theft that I could share with my readers.  According to Trish Hoffman, “…What we see in the history of identity theft and drugs is ⌠that⌡ they go hand in hand.”   Since I had only recently watched a television documentary about the prevalence of prescription drug abuse and drug-related crimes in the Miami and Dade County area, I was intrigued enough to try and find out more about this issue and how south Florida residents can protect themselves from this crime.

During this investigation, I quickly discovered some alarming statistics – for example, recent survey results have indicated that as many as 96% of medical providers admit that they have misplaced the sensitive medical and personal data of patients within the last two years.  This is surprising in light of the harsh penalties for violations of federal privacy laws such as HIPAA (Health Insurance Portability and Accountability Act) and HITECH (Health Information Technology for Economic and Clinical Health Act), which were enacted primarily to protect the public from these types of data and security breach, which have been shown to lead to medical identity theft.  This survey, which was conducted and published by the prestigious Ponemon Institute, also indicated that at least half of these incidents occurred due to the loss or theft of computers and other storage devices that contained the data, many of which were (admittedly) not protected by the organization prior to the loss of theft.  This has left patients in the Miami area worried – feeling not only vulnerable but alone in the fight to protect their confidential information.

Most medical professionals are familiar with the use of paper shredding as a means of effective medical records management and privacy law compliance; however, they these results indicate that much work is needed to improve the safety and integrity of sensitive data stored on hard drive computers.  For example, companies that are attempting to go “green” and be environmentally friendly routinely donate used computer hard drives to recycling centers or charitable organizations.  Although these businesses usually have someone go through and “delete” the records beforehand, the reality is that data stored on a hard drive cannot simply be erased with the touch of a button.  According to the professionals at south Florida’s most recognized hard drive destruction company, recordSHRED, there are only two ways to destroy a hard drive – either by crushing or by degaussing  (running a large magnet across the hard drive to wipe out the data).

recordSHRED has been serving the hard drive destruction needs of Miami and Dade County since 2003, and uses highly sophisticated equipment to ensure that the destruction process is complete.  recordSHRED’s machinery delivers and astounding 12,000 pounds of pressure within fifteen seconds, punching through the chassis and destroying the drive from the inside out – effectively neutralizing is and  guaranteeing that the data will be lost forever.  For more information on hard drive destruction, mobile shredding, degaussing, or any other data destruction service, please call (305)229-0102 or visit http://recordshred.com/destroy-hard-drive/.

One of the most important pieces of legislation passed by the federal government to safeguard the privacy of personal and confidential data is the part of the Insurance Portability and Accountability Act (HIPAA) known as the HIPAA Privacy Rule – distinguishing it from the other HIPAA provisions such as that which gives employees the option to continue insurance coverage after employment is terminated and that which precludes insurance companies from using preexisting condition as an excuse to raise premiums or deny coverage.  As discussed in Part 1 of this article, the provisions and restrictions of the entire HIPAA law apply only to what is known as “HIPAA Covered Entities,” which include basically any organization that handles patient health care records and sensitive clinical data – regardless of whether or not the company is actually considered to be a part of the medical industry (i.e. law offices, insurance companies, etc.).  We now shift the focus from identifying who is covered under HIPAA to exactly what is expected of these entities.

According to the Department of Health and Human Services Office for Civil Rights (OCR), HIPAA requires covered entities to do the following:

2.  Designate a privacy officer and contact person;
1.  Institute a required level of security for health information, including limiting   disclosures of information to the minimum required for the activity;

3.  Establish privacy and disclosure policies to comply with HIPAA;

4.  Train employees on privacy policies;

5.  Establish sanctions for employees who violate privacy policies;

6.  Establish administrative systems in relation to the health information that can respond to complaints, respond to requests for corrections of health information by a patient, accept requests not to disclose for certain purposes, track disclosures of health information;

7.  Issue a privacy notice to patients concerning the use and disclosure of their protected health information;

8.  Establish a process through an IRB (or privacy board) for a HIPAA review of any and all research protocols; and

9.  Include consent for disclosures for treatment, payment, and health care operations in treatment consent form (optional).

In summary, a HIPAA covered entity is prohibited from the use or disclosure of protected patient health information for any purpose other than that required for treatment, payment, or general health care operations without either the authorization of the patient or under a specific exception in the HIPAA regulations.  A good example of a scenario which does not meet these criteria is medical research such as that seen in prescription drug trials.  In addition, even with express permission from the patient, any data disclosed under HIPAA must be limited to only the minimum information required for the particular purpose.

Health care facilities in the Miami and Dade County region have found that one of the most effective ways to maintain HIPAA compliance is to regularly retain the services of a medical records destruction company such as recordSHRED.  recordSHRED stresses the importance of compliance with HIPAA as well as with all other federal and state privacy laws, which has earned the company the distinction of being given a AAA-Certification rating by NAID (National Association for Information Destruction), which is considered to be the highest standard in the destruction industry.  For more information on mobile or off-site medical records destruction and HIPAA compliance, please call (305)229-0102 or visit http://recordshred.com/business-shredding/medical-shredding/.

The US Federal Trade Commission (FTC) received approximately 250,854 complaints regarding issues of identity theft during 2010 – nearly one-fifth of the entire number of complaints received by the agency for that year.  2010 also marked the eleventh year in succession that identity theft was the subject most complained about by American consumers.  It will probably not ease the minds of worried Miami and Dade County residents to know that the FTC also released identity theft statistics which seem to indicate that Florida had the highest per capita rate of reported identity theft incidents, although Arizona and California are following closely behind.  Florida was also the state ranked highest in the number of medical identity theft complaints – due in large part to illegal prescription drug use and abuse.

In light of these statistics, it would seem that south Florida residents would take extra precautions to secure and protect the integrity of their confidential information.  Unfortunately, local law enforcement officials have indicated that this is not always the case, despite the growing popularity of companies such as LifeLock™, which provide support and constant monitoring (for a modest fee) to safeguard the identity of their clients.  According to experts, those who either cannot or will not pay for this type of service can often protect themselves by simply doing the following: (a) closely monitoring bank account and credit card activity and notifying bank immediately if any unauthorized or questionable charges are discovered; (b) using online bill paying and banking services whenever possible; (c) only carrying the credit cards and identification required  – and never carrying Social Security card in a wallet; and (d) calling local law enforcement immediately if noticing any suspicious activity such as “dumpster diving.”

Another precaution that is recommended for Miami and Dade County residents to protect their identity is to destroy confidential records using a professional paper shredding service such as recordSHRED.  recordSHRED has been serving the paper shredding and data destruction needs of the south Florida area since 2003, and the company has garnered many achievements – including the coveted and distinguished AAA-Certification from NAID (National Association for Information Destruction).   The paper shredding service at recordSHRED is compliant with all federal and state privacy laws, and employees are licensed and bonded.   recordSHRED offers both mobile paper shredding service and off-site document destruction within their access-restricted facility in Fort Lauderdale.  For more information, please call (305)229-0102 or visit http://recordshred.com/shredding-service/.

Jane Adams had only one goal on her mind for her annual spring cleaning.  The Miami housewife was determined to clean out her garage and workshop once and for all, although she was aware that it contained several years’ worth of tax records, banking information, credit card bills, and cancelled checks.  After speaking with her accountant husband and determining that they did not need to retain this information for any reason, she tackled the project – surprising both of them by completing it in less than two days time.  She ended up with four boxes of documents that she decided to have destroyed.  Meanwhile, a similar scenario was being played out on the other end of town, where Anna Lange was tackling the same task, only on a bit larger scale.  Anna, a widow, had the assistance of her seven grown sons and several grandchildren, so the task took a lot less time to complete.  The resulting cleanup yielded over thirty boxes of old documents, bank records, credit card bills, receipts, etc. that Anna and her late husband had accumulated over the past twenty years – all of which contained confidential information that made them ideal candidates for destruction and shredding.

Both of these situations perfectly illustrate a need on the part of the Miami residential community for paper shredding services.  One of the most often cited misconceptions that many people living in the Dade County area have is that paper shredding and document destruction services are to be used only by commercial businesses.  While it is true that local companies have a lot of incentive to use shredding – to protect their clients from identity theft and to protect their business from being hit with a costly privacy law violation – secure document destruction services are not only available but also recommended for those in the private sector.  What may be more difficult to determine for many residents is whether to opt for mobile shredding service or off site document destruction service.

Mobile shredding involves a truck equipped with shredding machinery to come out to the residence and perform the destruction services.  Mobile shredding offers not only the convenience of having the services performed at the home, but also the flexibility of allowing the customer to determine the time and date for the service.  Many mobile shredding trucks also have an onboard viewing system installed, so any nervous client can actually watch his or her documents being shredded.  This method is preferred for those with a large volume of documents – a situation similar to that of Anna Lange.  Those clients with a smaller amount of records to be destroyed, such as in the case of Jane Adams, are often more comfortable bringing in the boxes to an off-site shredding facility for service.

recordSHRED has been providing both mobile shredding and off-site document destruction services for Miami and Dade County residents since 2003, and the company has earned an excellent reputation for exemplary service and competitive pricing.  A signed Certificate of Destruction is provided at the conclusion of every job, and recordSHRED follows all federal privacy compliance procedures and standards.  For more information regarding either mobile shredding or off-site document destruction services, please call (305)229-0102 or visit http://recordshred.com/residential-shredding/.

What does an identity thief look like?  Does an identity thief possess distinguishing characteristics that set him or her apart from the rest of us?  Of course not – identity thieves are no easier to identify than any other type of criminal.  However, identity thieves can be even harder to catch because their crimes tend to be “silent,” happening in the shadows of the internet or in the dead of night as “dumpster divers” sort through our garbage looking for any shred of personal information which might give them unauthorized access to our bank accounts, credit cards, etc.  Another reason that identity theft is considered by many to be a “silent” crime is that it in many ways protects and favors the criminal – who is hiding under the umbrella of the identity and good name of an innocent person even as he or she is stealing from them and/or stealing from others.

The first question that comes to mind for those living in the Miami and Dade County area is how residents can protect themselves from this type of crime.  News stories abound of identity theft victims whose data was stolen from not only home garbage cans and the internet, but also from department store trash bins and doctor’s offices.  The simple fact is that data is pervasive – it is everywhere. 

It is in fact difficult in this age of technology, the worldwide web, and social networking to think of a situation in which we do not leave a proverbial data “fingerprint” behind as we go about our day to day business.  In recent years, as the benefits of paper shredding have become more widely known, many have turned their attention to the portable office paper shredders – purchasing these small machines thanks to extensive media hype that touted them as the solution to the identity theft problem.  This has actually exacerbated the problem rather than solving it – as thieves have honed their considerable skills to now include actually reconstructing the original document from the large shreds left behind after being shredded by one of these portable shredders.  Denial has also contributed to the high incidences of identity theft in the area, as many people simply do not want to think about the possibility of being an identity theft victim and choose to do nothing to protect themselves and secure their personal information.  Surprisingly enough, identity theft victims have actually included celebrities such as Tiger Woods and Robert Deniro, which proves that anyone is vulnerable to this type of crime.

The best way that Miami and Dade County residents can protect themselves is to retain the services of a professional paper shredding service such as recordSHRED.  recordSHRED has been serving the shredding and destruction needs of the south Florida community since 2003, earning the coveted AAA-Certification from NAID (National Association for Information Destruction), considered to be the highest standard within the paper shredding industry.  recordSHRED offers mobile shredding and drop off destruction services in a secure and access-restricted facility located in Fort Lauderdale.  For more information on the document destruction options available with recordSHRED, please call (305)229-0102 or visit http://recordshred.com/residential-shredding/.

No discussion of privacy rights and the various legislation designed to protect them would be complete without an introduction to the first of these laws, the Health Insurance Portability and Accountability Act of 1996, known to most of the general public by the acronym HIPAA.  Although the law was established in 1996, it actually did not go into effect until April 14, 2003.  HIPAA was and continues to be much lauded for the “portability” portion, which established COBRA insurance options for employees after they leave a company, as well as for its restrictions that prevent insurance companies from denying or raising their premiums for patient health care coverage based on past health records and preexisting conditions.  For most people, however, the most important component of HIPAA attempts to protect the privacy of individual patient health and personal information by establishing a federal standard concerning how this confidential data can be used and disclosed by what is referred to as a “HIPAA covered entity.”  It is also important to mention that HIPAA generally preempts all state privacy laws, except in cases in which the state law establishes a greater level of protection.

The first article in this series to provide a greater understanding of HIPAA is to define exactly who can be considered a “HIPAA covered entity.”  The term ‘covered entity’ has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations.

Section 160.103—
1) A health plan.

2) A health care clearinghouse.

3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter [e.g., HIPAA Administrative Simplification transaction standards].

In simpler terms, a HIPAA covered entity could be a health care provider, health plan (including an employer’s sponsored plan), a healthcare billing agent or insurance company, but can also include any organization or corporation that directly handles personal health information or personal health records.  A good example of one of these companies could be a law firm handling a malpractice case or personal injury litigation, a medical supply company, or even a local grocery store.  The grocery store actually provides an excellent example of a “hybrid,” which is a business which only partially meets the criteria mentioned above.  Although hybrids may only partially covered by HIPAA, those departments that are under the HIPAA umbrella may not share or transfer confidential health information to departments that are not covered without violating HIPAA.

Health care facilities in the Miami and Dade County area know that the best way to protect themselves and their patients from HIPAA violations is to retain the services of a professional medical records destruction company such as recordSHRED.  recordSHRED has been providing secure medical data destruction services to south Florida businesses since 2003, and the company’s excellent level  of service and enhanced security has earned a coveted AAA-Certification from NAID (National Association for Information Destruction), which is the highest standard in the industry.  Part two of this article will focus on what is expected of these HIPAA covered entities with regard to protecting our privacy, but for information on HIPAA compliance, please call (305)229-0102 or visit http://recordshred.com/business-shredding/medical-shredding/.