Before you head to the dumpster, a few tips:
• A good pair of garden gloves is crucial. You'll find lots of things you don't want to be touching in the dumpster.
• Don't dumpster dive alone. You don't know what (or who) you will find in or around the dumpsters. We did encounter other people rummaging through dumpsters.
• Don't break the law. Following the Prescription Privacy investigation, some pharmacies responded by placing "No trespassing" signs on their dumpsters and by installing locks, chains and metal fences around their trash. Know the law in your state and your town. Some municipalities have dumpster-diving ordinances. Most do not and penalties rarely exceed a $50 civil penalty, but it's important to know what the law is.
• Don't be Superman. If you have to cut through a steel padlock or scale a barbed-wire fence to get into the dumpster, it's hard to make the argument that the pharmacy is not making a good-faith effort to safeguard its customer private information. Putting sensitive records in the dumpster is not a HIPAA violation. Federal officials say putting the records into unsecured dumpsters is.
• Know where the information comes from. Not all personal records in a dumpster were put there by medical/ pharmacy staff. For example, we found plenty of personal customer information in trash bags filled with fast food wrappers and soda cans. We soon realized those bags likely came from the trash can in front of the pharmacy and, thus, the personal information found was likely thrown away by customers on their way out of the drug store. Other trash bags containing personal information were full of hundreds of drug manufacturer pill bottles, monthly sales figures from the drug store and employee work schedules. Those trash bags clearly came from employee access areas inside the pharmacy, and contained information that was most likely disposed of by drug store staff.
By Bob Segall
From the Spring 2007 issue of HealthBeat
Editors Note: This is a regular feature highlighting how reporters covered a major health story.
I spent my first summer in Indianapolis in a trash dumpster (actually, lots of them) and I blame it all on one of my photographers.
WTHR photojournalist Jim Hall told me about a fascinating crime in Bloomington, Ind., in which a grandmother was robbed at her front door. A man posing as a pharmacy technician duped the grandmother into thinking he had made a mistake while filling her prescription for Oxycontin, and he convinced her to hand over the pain medication so he could fix the alleged error. Police later determined the thief had found his victim by dumpster diving behind her pharmacy, where he found the victim's personal prescription records tossed out by the drug store.
While we were impressed by the criminal's creativity, we were also greatly disturbed by the pharmacy's recklessness. Jim and I decided to check other local drug stores to see if they were engaging in the same reckless behavior. After checking just a couple of dumpsters, it was obvious we had the makings of a great story.
Over the next two months, I visited dozens of pharmacy dumpsters around central Indiana with Jim and photojournalist Bill Ditton. The vast majority of those dumpsters were sitting wide open in drug store parking lots and inside we found hundreds of patient records including names, addresses, phone numbers and birth dates, as well as the medications the patients were taking and the doctors who had prescribed them. Clearly, the pharmacies were violating HIPAA by improperly disposing of customers' protected health information – something confirmed by federal officials when we took our findings to the Department of Health and Human Services in Washington, D.C.
Customers were furious. We used the records we had found in the trash to create a database of patients and began visiting them to show them what we had discovered behind their pharmacies. Most of the customers were more than willing to talk (some even agreed to an on-camera interview while in their pajamas!) to express their outrage. Walgreens and CVS, the nation's two largest pharmacy chains, admitted mistakes had been made that violated their own company policies. The drug store giants apologized, but then went on to make two critical mistakes.
First, they failed to take adequate action. Both CVS and Walgreens assured us the problem would be taken seriously and would be fixed right away. We waited a month, then checked dumpsters again. Again, we found hundreds of patient records in unsecured dumpsters – many of them in the same dumpsters that had failed our first inspection.
Second, they downplayed the scope of the problem. Walgreens and CVS representatives said the issue would be addressed by corporate management teams in Indiana. "What about outside Indiana?" I asked.
Both companies told me they thought the problems we discovered were isolated incidents limited to Indianapolis. After hearing that, I packed my bags for a 12-city nationwide dumpster-diving tour, which yielded thousands of additional patient records discovered in pharmacy dumpsters from Phoenix to Philadelphia.
That's when the pharmacies really took action, announcing significant changes to their trash disposal policies and steps to better protect customer information at more than 15,000 drug stores around the country.
The steps range from re-training tens of thousands of drugstore employees and transporting all pharmacy trash to regional warehouses for disposal to locking all dumpsters and building brick structures to enclose them. If we had not followed up to see whether the issue was more widespread and whether the drug store chains were keeping their promises, I believe none of those changes would have happened.
Keep in mind, this is a topic with high viewer/reader interest. Each time we aired a new part of our investigation, we were flooded with phone calls and e-mails. Because everyone does business with pharmacies and because identity theft has become such a popular and high-profile crime, the series attracted a great deal of local attention and high ratings.
Is this is a story in your town? It only takes a couple of hours to check. In the aftermath of WTHR's Prescription Privacy series, you might find the pharmacy dumpsters in your town locked or inaccessible to the public. (That is now the case in Indianapolis). If they are not locked, you probably will find all patient labels have been removed from pill bottles and patient information sheets are not mixed in with the trash. However, if you do find patient records in unsecured pharmacy dumpsters, you have a story! It is a violation of HIPAA and the national pharmacy chains have publicly promised they would take steps to ensure the confidentiality of patients' private information.
While you're at it, you can check dumpsters at hospitals, health care clinics, medical testing labs and other health care-related facilities that may be violating patients' privacy rights as a result of poor record disposal practices.
Bob Segall is chief investigative reporter at WTHR-TV, the NBC affiliate in Indianapolis. Prescription Privacy was honored with a 2006 AHCJ Award for Excellence in Health Care Journalism and a 2006 Peabody award.
