Home
>
News
>
Local News
Disclosure law doesn’t cover misplaced documents
State law governs data in computer systems, AG spokesman says.
Hot Topics
By Josh Sweigart,
Staff Writer
12:59 AM Sunday, June 13, 2010
HAMILTON — If a government misplaces a pile of documents containing confidential information in a Dumpster, they don’t have to tell anyone. If they lose a password protected laptop computer, state law requires public disclosure within 45 days.
That is why Butler County wasn’t required to tell the 10,600 people potentially affected by a security breach in 2008 that their records may have been tossed in a public trash bin — where at least one member of the public saw it — according to the Ohio Attorney General’s Office.
“(The law) applies to data in a computer system, security breaches,” said Ted Hart, spokesman for the Attorney General’s Office, which is responsible for enforcing the provision. “The law is specific to data theft and hacking and security systems.”
The state law created in 2007 requires state agencies and their political subdivisions that keep computerized data to disclose any breach of their system to residents made at risk of identity theft or fraud.
The law gives agencies 45 days after they find a security breach to notify the public.
The law was created the same year a data storage device containing information about 64,467 state employees was stolen from the car of an intern who worked for the state.
In response, the state paid $660,000 for all affected employees to be given access to a free credit monitoring service.
‘The right thing to do’
Similar laws also apply to some private agencies, such as hospitals. When Cincinnati Children’s Hospital discovered a laptop computer was stolen from an employee’s home in March, the hospital had to send a letter notifying more than 61,000 people.
The letter informs people that the laptop contained names, medical record numbers and hospital services received. It did not include Social Security numbers, telephone numbers or credit card info, the letter says. The information was password-protected, but not encrypted.
“While there is no evidence there has been an attempt to misuse any of the personal information, Cincinnati Children’s believes it is important to notify you,” the letter reads. “Cincinnati Children’s is committed to providing the highest level of care for its patients and families and that includes protecting personal information.”
In addition to the legal requirement, hospital spokesman Thomas McCormally said telling the public was “the right thing to do.”
“This is not the way that we like to do business, and we have staked our names and our reputation around patient quality and doing the right thing,” McCormally said. “When things like this happen, it means we have to redouble our efforts and see what we can do to do even better.”
The hospital also set up a hot line for those affected, and contracted with the Oregon-based company ID Experts to provide people with identity theft protection.
“Obviously, this is a big undertaking to notify families and then go the extra step of offering the credit protection that ID Experts will provide,” McCormally said.
State law mum on common mistake
In addition to a lack of enforcement of such matters, the state Attorney General’s Office says there is little in state law dictating disposal of confidential records.
Pari Swift, senior records manager at the Attorney General’s Office, said there is nothing in state law that “specifically governs the disposal of public documents.”
“There are other federal regulations that do specify how certain types of information need to be disposed, such as HIPAA,” Swift said. “I’d recommend just being smart about it. If a document contains confidential information, destroy it in a way that would completely obscure that information.”
Although cities are required to create a retention schedule for public documents, laying out exactly how long they will keep various items on hand, she said nothing controls how they are disposed of outside of that time period.
The Ohio Historical Society then receives those documents for review, where they determine whether a copy should be maintained for “enduring historical value,” Swift said. Once the Historical Society has a say, however, Swift said governments can go ahead and dispose of the records any way they please.
In March, a mound of documents from the city of Middletown was found to have been left in a public trash bin at Smith Park for weeks. Some contained Social Security numbers, phone numbers and carbon copies of checks.
City officials said they don’t know how it happened, but they suspect the documents started in a recycling bin, just as the county’s records did.
“Somebody made a mistake and threw something away that should have been shredded,” city Law Director Les Landen said at the time. “We do have a policy and process for getting rid of confidential and sensitive documents, but that clearly was not followed here.”
A similar incident of public information being improperly disposed of occurred slightly more than one year ago on June 26, when attorney William Bowen dumped stacks of business and real estate case files in a public trash bin.
Staff Writer Ryan Gauthier contributed to this report.
Share this article
Breaking news by e-mail
Start your day with top headlines in your inbox and get breaking news e-mail alerts at any time by subscribing to our Headlines e-mail newsletter.
See Sample | Privacy PolicyView All
Top Jobs
 |
 |
Lastest news blog posts
About our ads
About our adsCopyright © 2010 Oxford Press, Oxford, Ohio, USA.All rights reserved.
By using this site, you accept the terms of our Visitors Agreement and Privacy Policy. About our ads. You may wish to note our other business policies.
12:06 PM, 6/14/2010
9:12 AM, 6/14/2010
12:40 AM, 6/14/2010
10:32 PM, 6/13/2010
5:25 PM, 6/13/2010