March 27--An Overland Park woman made a disturbing discovery Saturday as she dumped her recycling inside a yellow and green bin in front of Brookridge Elementary School:
More than 1,000 private abortion records sat in plain view, tossed on top of magazines and newspapers in a possibly serious violation of federal privacy law.
Even a cursory look at the records, most from 2001 and 2002, showed they contained the most intimate and private of information in patients' own writing.
The records, typically four to six stapled pages, included women's names, birth dates, telephone numbers, Social Security numbers and emergency family contacts, a spot check indicated. The first page provided the patients' health history, number of children, term of pregnancy and previous abortions, if any, along with fees paid for the procedures.
Labels scrawled on some documents identified patients as "minor," meaning the girls were under age. Some said patients had "changed mind" or were "too far" along in their pregnancies.
A scan of records revealed home addresses from most every county in the Kansas City area and beyond, from Topeka to Freeman, Mo.
Outraged, the woman who saw the documents called the Overland Park police, who did not respond, and then called her daughter, a 45-year-old nurse with more than 20 years' experience, who contacted The Kansas City Star.
"My head just about spun off my shoulders," said the nurse, who preferred to remain anonymous. "No one should have these records."
The Overland Park Police Department conceded it erred Saturday in not immediately responding to the call.
"Our dispatcher made a mistake by not sending out an officer to check it out," Capt. Erik Hulse said.
By Monday afternoon, law enforcement and state agencies, including the Overland Park police, Johnson County district attorney's office and the Kansas Board of Healing Arts, were seeking information about the documents and their safekeeping. Overland Park police said they were investigating.
The patient records are all from a now-defunct clinic, Affordable Medical and Surgical Services in Kansas City, Kan., run by then-physician Krishna Rajanna. They were retrieved by a Star reporter and placed under lock and key, rather than being left out in public.
Reached by telephone Monday at his Overland Park home, Rajanna, who is in his mid-70s, conceded that on Friday he simply threw away the stacks of personal documents he had kept in his home, a few blocks from the school.
"I was under the impression that these would not be seen by anyone," said Rajanna, who lost his medical license in 2005 and whose clinic closed that same year. "I thought that these would be recycled away just like any other papers."
Kansas law requires that all medical records be kept a minimum of 10 years. But hundreds of the discarded records were less than 10 years old, dated after March 2002.
The Star informed Rajanna of the fact Monday.
"Some of them might have been mixed up that way," he said. "We tried to get all the ones that were 10 years or older. I probably would want to look at them again, if you'll be kind enough to give me the records so I can take a second look and re-sort it differently."
Ever since the 1996 federal Health Insurance Portability and Accountability Act, known as HIPAA, took full effect in 2003, it has been a federal violation to release private medical information without patient permission or other authorization. Fines range from as little as $100 to as much as $1.5 million per violation.
HIPAA privacy rules do not dictate exactly the manner in which doctors, hospitals, pharmacies or other "covered entities" are to dispose of "protected health information." But specific rules are clear.
Among a list of frequently asked questions provided by the Department of Health and Human Services, which enforces HIPAA, is this:
Q. May a covered entity dispose of protected health information in dumpsters accessible by the public?
A. No, unless the protected health information (PHI) has been rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed prior to it being placed in a dumpster. In general, a covered entity may not dispose of PHI in paper records, labeled prescription bottles, hospital identification bracelets, PHI on electronic media or other forms of PHI in dumpsters, recycling bins, garbage cans, or other trash receptacles generally accessible by the public or other unauthorized persons.
"This is a particularly egregious matter to have abortion records treated in this fashion," said Susan McAndrew, a deputy director in HHS' Office for Civil Rights. "I'm glad this man is no longer practicing."
Rajanna on Monday said he discarded what he thought were "probably about 500 records" from his former clinic at 1030 Central Ave., in Kansas City, Kan., because they were "old records that are out of date." He thought they would be picked up quickly.
That would not have been the case.
The two unlocked recycling bins, owned by AbiBow Recycling in Houston, are emptied monthly. The last time was on March 15. They were not scheduled to be picked up for about three more weeks.
The contents of the bins are then taken to a processing center in Kansas City, Kan., where the papers are placed on a conveyor belt so that garbage and other nonrecyclable material can be separated.
The nurse whose mother found the records did not want them exposed to the public for days. After calling the police, she also contacted the local FBI office and the Johnson County Sheriff's Department. A spokesman for the sheriff's office said that although the department has jurisdiction over all of Johnson County, it is the kind of call that would be referred to the police, as occurred in this instance.
The FBI said Monday it could not comment on whether its office received a call.
Outrage on both sides
Both abortion opponents and abortion-rights advocates responded with outrage to the public disposal of abortion records.
Mary Kay Culp, executive director of the anti-abortion group Kansans for Life, said it was just one in a number of examples of abortion providers showing no real care for women.
"This is not unusual for records to be dumped like this," she said. "This shows they don't have any real concern about women's privacy. What they have concern about is their own bottom line and distracting the public about privacy issues in order to avoid genuine investigations."
Culp said Rajanna was essentially the poster boy for abortion clinic regulations.
Between 2000 and 2005, Rajanna was either fined or disciplined four times by the Kansas Board of Healing Arts, which ultimately revoked his license. Inspectors who visited his clinic in 2005 reported it was unclean, with syringes of medication kept in an unlocked refrigerator. A dead mouse was found in a hallway.
That same year, the state of Rajanna's practice became the focus of a legislative debate in the Kansas Statehouse over regulating abortion clinics.
Peter Brownlie, chief executive officer of Planned Parenthood of Kansas and Mid-Missouri, called the dumping of the records "awful."
"What a gross violation of a woman's privacy," he said. "I've never heard anything quite like it."
Brownlie said that his organization retains abortion records in secure long-term storage "forever." The organization does destroy other non-abortion related records after holding them for the legally required amount of time, he said.
Jeff Pederson, manager of the Aid for Women abortion clinic in Kansas City, Kan., said he couldn't understand what Rajanna could have been thinking.
"That's stupid," Pederson said. "That's why they have shredder services. The state law doesn't say exactly how to discard them, but you're required to keep things confidential. I've never heard of anyone putting them in recycle bins."
He said one former physician's neglectful treatment of women's privacy "gives us all a huge black eye."
"I'm sure women are going to feel frightened as hell," he said, "and now will be less likely to want to give truthful information about their contact info or their real name."
Questions linger
What, if any, actions might be taken against Rajanna remain unclear. As of Monday, questions still lingered regarding whether Rajanna and his former practice were covered by HIPAA.
The act, in part, was designed to help safeguard privacy in the age of electronic transfer of documents. Medical providers that have never transmitted payment or other information to third-party payers electronically are not subject to HIPAA regulations.
Cash-only businesses are one example. On Monday, Rajanna said that his clinic was cash-only, although some of the retrieved records clearly showed photocopies of insurance cards on the back page.
McAndrew said that the HHS civil rights office has some 230 investigators in 10 regional offices, including one in Kansas City. Together, the offices receive about 9,000 HIPAA violation reports each year.
About two-thirds, she said, are discovered to be either beyond the agency's jurisdiction or not worth pursuing. But the office does close 2,500 to 3,000 cases each year and levies fines, including judgments in recent years against business including CVS pharmacies, for $2.25 million; Rite Aid Corp. for $1 million; and, earlier this month, BlueCross BlueShield of Tennessee for $1.5 million.
McAndrew said that the Kansas City office would have to determine whether to go forward with an investigation.
"It does get tricky because he is no longer practicing and the clinic is no longer in existence," McAndrew said. "Even fining him, it could end up being an empty enforcement action. I'm not even sure what kind of assets he might have."
Rajanna wishes now he could have the documents back and do it all over again. On Monday, he hoped they would be returned to him.
"If you have them collected," he told The Star, "I'll just take them back and burn them or discard them in a different way.
"I could just incinerate them just as well, I suppose. But usually that means we are creating more smoke."
The Star's Dave Helling and Darryl Levings contributed to this story.To reach Eric Adler, call 816-234-4431 or send email to [email protected]. To reach Judy L. Thomas, call 816-234-4334 or send email to [email protected].
Copyright 2012 - The Kansas City Star, Mo.
