Storage & Shredding: Expert Advice

Improper Document Destruction offenders EXPOSED

Posted by Sean Kelly on Mon, Nov 26, 2012 @ 12:33 PM

 

confidential file image

 DO NOT, I repeat, DO NOT let this happen to you! Even though everyone says "oh, it won't happen to me", don't be that person. It can, and will, happen to you. What is 'it' though? 'It' is the heavy imposition of FINES on you for the improper disposal of sensitive information. These fines are imposed by both Massachusetts state laws (93H and 93I which require the proper destruction of information containing social security numbers, driver's license numbers, financial account numbers, and credit or debit card numbers) as well as federal regulations like HIPAA that require the secure destruction of PHI (protected healthcare information)as well as FACTA. If anything is to be taken away from this blog, it should be that the DUMPSTER is NO PLACE for the disposal of any kind of sensitive record. If you even have to question whether or not the information is "sensitive", then it probably is. Too many times companies, large and small, are exposed, and fined heavily, for disposing of sensitive information belonging to their clients, patients, or customers simply into the trash. 

For the companies that don't heed warning and do not take the proper steps to ensure the security and proper disposal of sensitive information, they are used to make examples of what NOT to do. This is done by way of news reporters plastering the names of companies, and what they did, all over the headlines. For example, big corporations like RiteAid, Walgreens, and CVS were all EXPOSED for their improper disposal of private prescription information. Hitting closer to home, St. Elizabeth's Medical Center is investigating how patient financial information was found floating around on the streets outside of a building in Charlestown. Thankfully, the hospital is taking the correct measures to ensure that this does not happen again. Also, the hospital did what it is required to do by law when a data breach of this sort happens and they notified the Massachusetts Attorney General's office. 

Then, we come across a more interesting situation where SHREDDED PAPER was used as confetti in the Macy's Thanksgiving day parade. So what's the big deal? We'll the shreds were very thick and cut perfectly horizontal across the paper so that perfectly clear lines of text were able to be read, including social security numbers, and other sensitive information. It is clear that a typical office shredder was used to shred these documents since that is the common level of "security" that an office shredder provides. The differences between an office shredder and a commercial shredder is the level of security in the 'cut' of the paper. Security levels 1-6 exist with the higher the level, the higher the security of the cut. Office shredders typicall have level 1 or 2 security where the shreds of paper are thick, easy to read and easy to reconstruct. Security levels 3 and 4 give consequtively smaller cuts of paper and allow for cross-cutting, inhibiting the readability of the shreds as well as inhibiting the ability to reconstruct the shreds. Security levels 5 and 6 are recommended for destroying top-secret government or research documents due to the shreds coming from this shredder being like grated-cheese. It is typical of a commercial shredding company to have a shredder with a security level from 3-6. Then, in some instances, a reputable shredding company will go one step further and have your shreds pulverized and recycled. 

The one thing that could have made a huge difference in each of these three situations is if the drug stores, the hospitals, and the police stations had all used a document shredding and storage company for their storage and destruction needs. Although the actions of safe and secure document storage and destruction seem straight forward and simple, they are best to be left in the hands of those companies who make it their sole purpose to protect information (yes, even AFTER it is shredded!). 

Tags: data protection, document shredding services boston, compliance laws, records, Massachusetts State Laws, 93I, Protected health information, 93H, Document Destruction regulations, compliance, privacy, PHI, shredding services

It's 3:00 P.M, do YOU know where your personal documents are?

Posted by Sean Kelly on Mon, Nov 12, 2012 @ 03:47 PM

You read it right, we're asking: Do you know where your personal documents are? And no, we aren't talking about the documents you keep in a filing cabinet, in a kitchen drawer, or a home office. We're talking about the personal information you've left with anyone who you have ever given it to... your bank, your doctor, your lawyer, your accountant, etc. Do you know what is done with your documents? Well, in most cases, youshould feel secure leaving your information with a reputable company who uses a professional document shredding service to securely destroy your information. Unfortunatly, as detailed in this news video, sometimes your personal information can be just thrown in the trash by those who have no regard for the safety of their clients or patients information. 

Are your documents being securely shredded?
 A trash collector found these documents
containing sensitive personal information in a 
dumpster, and even found a copy of a social
security card.

 

So now you ask, well how can I be sure that the people who deal with my sensitive information aren't just throwing it away? Of course you cannot police them, but what you can do is be an educated consumer of the services you are using, and when you know your sensitive information is going to be in the hands of a service provider, all you have to do is ASK! Don't be afraid, your identity and financial information may be at risk. All it takes is a simple question of "will all of my information be securely shredded when you're done with it?". The answer will either be "Why of course, we use company XYZ to shred all of your client/patient information" or it would be "No", or maybe "we plan on starting up services sometime in the near future", or any type of explanation to make it sound not-so-bad that they aren't using a shredding company. Either way, when you ask, you are only doing a service to yourself and the fellow consumer. Maybe your question will prompt that company to call their shredding service provider to have them remove sensitive documents (some of which may be yours!), or, maybe your question will prompt them to START using a document shredding company. The outcome will be positive, no matter what. 

As a consumer, you have a right to DEMAND the safety of your information. Thankfully, Massachusetts and most states have laws that affect the types of businesses that handle sensitive information and so you can feel comfortable knowing that those businesses are required by law to keep your information safe. Regardless, it never hurts to ask. You never know whose sensitive information you could be keeping from going into the trash.   

Tags: 93I, Federal FACTA, Protected health information, 93H, Document Shredding, document storage, shredding services