KANSAS CITY, Mo. -- An Overland Park, Kan., woman made a disturbing discovery Saturday as she dumped her recycling inside a yellow and green bin in front of Brookridge Elementary School: More than 1,000 private abortion records sat in plain view, dumped on top of magazines and newspapers in a possibly serious violation of federal privacy law.
Even a cursory look at the records, most from 2001 and 2002, showed they contained the most intimate and private of information in patients' own writing.
The records, typically four to six stapled pages, included women's names, birth dates, telephone numbers, Social Security numbers and emergency family contacts, a spot check indicated. The first page provided the patients' health history, number of children, term of pregnancy and previous abortions, if any, along with fees paid for the procedures.
Labels scrawled on some documents identified patients as "minor," meaning the girls were under age. Some said patients had "changed mind" or were "too far" along in their pregnancies.
A scan of records revealed home addresses from most every county in the Kansas City area and beyond, from Topeka, Kan., to Freeman, Mo.
Outraged, the woman who saw the documents called the Overland Park police, who did not respond, and then called her daughter, a 45-year-old nurse with more than 20 years' experience, who contacted The Kansas City Star.
"My head just about spun off my shoulders," said the nurse, who preferred to remain anonymous. "No one should have these records."
The Overland Park Police Department conceded it erred Saturday in not immediately responding to the call.
"Our dispatcher made a mistake by not sending out an officer to check it out," Capt. Erik Hulse said.
By Monday afternoon, law enforcement and state agencies, including the Overland Park police, Johnson County district attorney's office and the Kansas Board of Healing Arts, were seeking information about the documents and their safekeeping. Overland Park police said they were investigating.
The patient records are all from a now-defunct clinic, Affordable Medical and Surgical Services in Kansas City, Kan., run by then-physician Krishna Rajanna. They were retrieved by a Star reporter and placed under lock and key, rather than being left out in public.
Reached by telephone Monday at his Overland Park home, Rajanna, who is in his mid-70s, conceded that on Friday he simply threw away the stacks of personal documents he had kept in his home, a few blocks from the school.
"I was under the impression that these would not be seen by anyone," said Rajanna, who lost his medical license in 2005 and whose clinic closed that same year. "I thought that these would be recycled away just like any other papers."
Kansas law requires that all medical records be kept a minimum of 10 years. But hundreds of the discarded records were less than 10 years old, dated after March 2002.
The Star informed Rajanna of the fact Monday.
"Some of them might have been mixed up that way," he said. "We tried to get all the ones that were 10 years or older. I probably would want to look at them again, if you'll be kind enough to give me the records so I can take a second look and re-sort it differently."
Ever since the 1996 federal Health Insurance Portability and Accountability Act, known as HIPAA, took full effect in 2003, it has been a federal violation to release private medical information without patient permission or other authorization. Fines range from as little as $100 to as much as $1.5 million per violation.
HIPAA privacy rules do not dictate exactly the manner in which doctors, hospitals, pharmacies or other "covered entities" are to dispose of "protected health information." But specific rules are clear.
Among a list of frequently asked questions provided by the Department of Health and Human Services, which enforces HIPAA, is this:
Q. May a covered entity dispose of protected health information in dumpsters accessible by the public?
A. No, unless the protected health information (PHI) has been rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed prior to it being placed in a dumpster. In general, a covered entity may not dispose of PHI in paper records, labeled prescription bottles, hospital identification bracelets, PHI on electronic media or other forms of PHI in dumpsters, recycling bins, garbage cans, or other trash receptacles generally accessible by the public or other unauthorized persons.
"This is a particularly egregious matter to have abortion records treated in this fashion," said Susan McAndrew, a deputy director in HHS' Office for Civil Rights. "I'm glad this man is no longer practicing."
Rajanna on Monday said he discarded what he thought were "probably about 500 records" from his former clinic in Kansas City, Kan., because they were "old records that are out of date." He thought they would be picked up quickly.
That would not have been the case.
The two unlocked recycling bins, owned by AbiBow Recycling in Houston, are emptied monthly. The last time was on March 15. They were not scheduled to be picked up for about three more weeks.
The contents of the bins are then taken to a processing center in Kansas City, Kan., where the papers are placed on a conveyor belt so that garbage and other non-recyclable material can be separated.
The nurse whose mother found the records did not want them exposed to the public for days. After calling the police, she also contacted the local FBI office and the Johnson County Sheriff's Department. A spokesman for the sheriff's office said that although the department has jurisdiction over all of Johnson County, it is the kind of call that would be referred to the police, as occurred in this instance.
The FBI said Monday it could not comment on whether its office received a call.
(The Star's Dave Helling and Darryl Levings contributed to this story.)
(c)2012 The Kansas City Star (Kansas City, Mo.)
Visit The Kansas City Star (Kansas City, Mo.) at www.kansascity.com
Distributed by MCT Information Services