A News 3 investigation has uncovered a startling find -- thousands of documents with private patient information abandoned in a public place, putting hundreds at risk.

It's information you wouldn't want anyone to see, and something medical professionals are supposed to be protect.

They say one man's trash is another's treasure. But what if that trash really turned out to be a gold mine?

Each time you take your trash to the curb, or watch the garbage truck pass you by, you probably aren't thinking that your money, identity, or your entire life could be thrown out with the trash.

But that potential for disaster is exactly what we found at a county landfill after News 3 received a tip from an anonymous viewer, regarding hundreds of medical records floating around a dumpster. The documents included patient names, addresses, social security numbers and medicaid numbers laying out for all to see.

The records were also within arms length of those coming in and out to dump their trash.

News 3 was able to obtain just under 80 records from the site. In them, we found the perfect formula to steal a person's private information.

"There are generally prohibitions for anyone who has the responsibility for medical records, not to just throw them away, they have to be obliterated," Mary Herring with the Texas A&M Health Science Center.

Herring has served on the Texas Medical Board, and is currently a professor at the Texas A&M Health Science Center. She says shredding or burning medical records is the prescribed plan for destruction so private patient information isn't compromised.

"Often times, we see the breakdown in staff who don't know how they're destroyed, when they can be destroyed, or how long they can be held," Herring said.

So we called the company whose name is found on the front of the files: Daniel Jarvis Home Health Agency.

"I don't know what happened, that's really weird. They weren't shredded at all? We usually burn all our old files," Daniel Jarvis Management said.

The manager went on to say, "The only thing I can imagine is we cleaned out our storage area here in our facility. I'm wondering if someone thought that was something that was supposed to go to storage and they dumped it in the bin."

Regardless of how the files ended up at the landfill, it's considered a violation of patient privacy.

Current guidelines under the U.S. Department of Health and Human Services state that throwing public health information into a trash dumpster accessible by the public, or other unauthorized person, "is not an appropriate privacy or security safeguard".

In fact, HIPPA rules state that more care should be given to health records containing private information, like social security numbers, since "access to this information may result in identity theft, employment or other discrimination, or harm to an individual's reputation".

So a News 3 team began investigating what could be done with the records found, and contacted a number of state and government agencies.

We also began the daunting task of creating a master list with every patient record obtained by News 3, and then made call, after call, letting those affected know what happened.

"Are there more files out there? That's the question you have to ask," one patient whose file we found said. "How about the other people out there who have loved ones like me asking are my files out there?"

News 3 was only able to secure a small portion of the files that were found because of how widespread they were. In fact, roughly five other boxes full of files labeled with differing medical terms were also on the site, in addition to the two we found.

In Part Two of Private Information, Public Disclosure, we'll talk to the patients whose files we found, and hear how this ordeal has changed their life.
That's coming up Tuesday night, on Ten at 10.
---------------------------------------------------------

Part 2

It happens to nearly nine million Americans every year, and can take years and even hundreds of dollars to fix.

Identity theft happens when someone gets ahold of your private information and then uses it without permission to commit fraud or other crimes.

So how would you feel if that private information was compromised? It's a question we asked dozens of patients here in our area after we uncovered their medical files floating around in a public landfill.

"Here's a doctors name I recognize," Brenham resident Sue Dixon says looking at her medical file.

Behind every file there's a face.

"When you go to a doctor you want to be able to trust, and trust your private information especially your social security numbers and address of all things," Dixon said.

Brenham resident Sue Dixon never gave much thought to identity theft, until we contacted her to tell her that her medical file, along with nearly 75 others, were found in a College Station landfill with private and personal information within arms reach of passers-by.

"It gave me a headache, a neck ache--it was just so frustrating," Dixon said. "I didn't hardly know what to do, here I was thinking- what could I do?"

Now Dixon can't shake the feeling that her identity and personal information has been compromised.

"You live in a small town and you don't hear too much in a small town happening, but yet things happen all the time," Dixon said.

So we tried contacting every patient whose file we found to let them know what happened so they could be on the lookout.

We also gave them the option to pick their file up right here at our studios, with proper ID, information, and signature to claim the records.

"I certainly appreciate this," Mildred Carlton said." "To think they just chunked it."

Mildred Carlton came to pick up her son Jesse's records, because he couldn't do so himself.

Jesse suffers from short term memory loss and Carlton fears someone could have taken advantage of that.

"The identity they could take....he's on Medicaid, anyone could use that," Carlton said."

We heard similar stories throughout the day.

From those who wished to remain anonymous...

"My mother and she's wide open and so we as a family are wide open. So, yes it does make me mad," one family member of the affected said.

And others still shocked by the news.

"It makes you so leery because of the damage it can do," Sharon Putz said.

It's damage Rebecca Olsen knows first hand.

"I have been a victim. Somebody had my social security number," Olsen said.

"They purchased a car, they almost purchased a house, they got credit cards... they became me," Olsen said.

So when Olsen got the call from us telling her we found her medical file, once again the panic set in.

"Not again. I was just paralyzed because it is so scary to realize somebody can do this so easily," Olsen said.

"This is something we take reports for daily," Sgt. Janice Kemp with College Station Police Department said.

College Station Police Officer Janice Kemp teaches education courses to keep people from becoming identity theft victims.

She's says one of the best ways to protect yourself is to ask questions.

"Argue about your social security card, it's not a form of ID. If somebody wants it at a doctor's office, really question them," Kemp said. "Why do you want my social security number? Who is going to have access to it?"

It's something the patients we talked to say they will definitely do in the future.

"When I fill out the next form, I'm going to say what happens when the time comes and this file needs to be disposed of where is it going," one patient said.

But as for now...

"There's just no excuse for whoever did this," Rebecca Olsen said.

"They should probably be more careful who they get to take care of these files," Mildred Carlton said.

"I'm so thankful it's been caught, in my case anyway," Sharon Putz said.

Brenham resident Sue Dixon though, isn't leaving anything to chance.

She's already contacted the credit bureaus and put fraud alerts on her accounts. But she still wonders if it's enough.

"How long do I have to live with it? They said for me to contact the credit bureaus every three months for a year--well that's going to cost me money," Dixon said.

Taking a proactive approach like Sue Dixon did and placing a Fraud Alert on reports or accounts is one of the first things the Federal Trade Commission advises people to do if they suspect they may be a an identity theft victim.

Some other things you at home should be on the lookout for are:

- bills that don't arrive on time.

- unexpected credit cards or account statements.

- denials of credit for no apparent reason.

- or calls and letters about purchases you didn't make.

In part 3 of our series, Private Information, Public Disclosure, we'll take a closer look at enforcement for mishandling of records, and some of the fines and penalties that can be accessed, we'll also show you how the state has become involved in our investigation.

That's coming up Wednesday night on Ten at 10.

For more information on Identity Theft, click on the links below:
-----------------------------------------------
Part 3

It's one of the most investigated types of compliance issues the Department of Health and Human Services deals with: a lack of safeguards to protect private health information.

Throughout the week, we have shown you what can happen when your private information falls through the cracks. Now, we take a closer look at some of the laws and penalties in place designed to protect you.

"There's my social security number," Rebecca Olsen said as she looked at her medical file. It's a nightmare she hopes she never will wake up to again.

"You think it's just a mistake, and then it goes on and you become very suspicious of everything, and your whole life is turned upside down," Olsen said.

It's been several years since Olsen first became a victim of identity theft, but looking at her medical file we found in a College Station landfill, a feeling of déjà vu overwhelms her.

"All the information is there numbers, addresses, phone numbers, and then the confidentiality of your medical condition," Olsen said.

In all, News 3 secured nearly 80 medical files containing all sorts of private patient information, all thrown away with the trash.

So we got on the phone contacting patients whose names we found in the files, along with state and government agencies like the Department of Health and Human Services, and the Attorney General about privacy rules and enforcement.

We then made multiple attempts to contact the Home Health Agency we found all over the files, Daniel Jarvis Home Health, first by phone, and then in person. But after being told a supervisor wasn't available to talk to us, we received word from the home health agency through an e-mail written from their attorney asking for the files we found back.

"It is our position that you are now holding property that belongs to Daniel Jarvis Home Health. Your failure or refusal to return the same will be considered a conversion and we will seek all damages that may be available," the letter states.

Soon after KBTX received that letter, we received another also expressing interest in the files our investigation uncovered, this one a subpoena from the Attorney General's Office.

"This material is relevant to the subject matter of an investigation of Daniel Jarvis Health Care for possible violations of the Deceptive Trade Practices Consumer Protection Act," it reads.

The letter goes on to say the investigation involves possible misrepresentations made by Daniel Jarvis in regards to the privacy and security of customer records.

A day after we got the letter, a representative from the AG's office came to pick the records up for further investigation, an investigation they say will also examine whether one of the AG's newest weapons against identity theft was violated: the Identity Theft Enforcement and Protection Act. Officials say that can be applied to businesses that mishandle consumers' personal information.

Problems protecting patient information is a disturbing trend that seems to be on the rise. Since the compliance date in April 2003, the Department of Health and Human Services has received almost 42,000 HIPPA privacy complaints.

Nearly 8,000 of those cases have been investigated and resolved. Another 4,000 were investigated with no violation found. But there's nearly 24,000 other completed cases where the government says the complaint did not present an eligible complaint, meaning more than half resulted in no action.

It's a startling statistic for those who have been affected in the past, and now feel threatened again in the present.

"There's no excuse for taking a short cut, and just dumping it," Olsen said.

She knows first hand the damage having your personal information out there can do and how long it can take to restore a feeling of security.

"It takes a long time. You have to notify everyone including your doctors and your insurance company, and the banks, social security, everybody," Olsen said.

As for some of the fines and penalties a company can face for not protecting private information, that depends on the government or state agency. For example, in some cases, the government will work with a company to get it back on track. But in other cases, there can be jail time or even some pretty stiff fines.

The AG's Identity Theft and Enforcement Act can carry a maximum fine of up to $50,000 per violation, while the Deceptive Trade Practices Act can run up to $25,000 a violation.

Civil fines for the Department of Health and Human Services run $100 per violation up to $25,000. Criminal penalties can run up $250,000, plus up to ten years in prison.

A representative from the AG's office tells News 3 they are currently reviewing the files we turned over to them. They say cases like these take time to develop and can take eight months to a year to reach a resolution.