1

When Athens native Bobby Roberts placed a bid of more than $1,000 for the contents of a delinquent storage unit in Florence, he said he thought he was buying medical equipment and maybe old office files.

But on Sept. 10, when he opened the 20 or so boxes in the unit at Climate Guard Self Storage on Florence Boulevard, he discovered the boxes were filled with personal medical records from Digital Diagnostic Imaging Inc. Some were from as recently as 2009, while others dated to 2002.

Included on those records were not just medical details but patients’ Social Security numbers, addresses, phone numbers, insurance information and driver’s licenses.

Roberts said when he placed the bid, he didn’t know he was buying private information.

“Each unit had its door up with three pieces of caution tape up over (the entrance),” he said. “We couldn’t go in, we could just look.”

Digital Diagnostic Imaging, located at 416 Dr. Hicks Blvd. in Florence before closing in December 2009, performed ultrasound, EEG and others tests, according to Susan Cole, who said she worked as an ultrasound technician for the company.

A primary care physician would order the tests, Cole said, so they would have received copies of the results, and patients had access to their records through their doctors.

Steve Vickery, who served as Digital Diagnostic’s vice president, said he had a heart attack near the time the business was closing. The company’s president died, and a man named Randall Spradlin was appointed as acting president and was charged with shutting down the business, Vickery said.

Vickery said most of the records were to be moved to the company’s main office in Russellville.

“We rented a unit because we started getting too many (records) there at the (Russellville) office, so we had to have a backup storage facility,” he said. “(Spradlin) was in charge of everything as far as paying our bills. Obviously, he didn’t pay for this storage facility.”

Vickery said up until Roberts’ discovery, he didn’t know there were records still in the storage facility. He said he thought they had all been moved because they needed to be kept for five to seven years and were used for billing purposes.

“I thought (Spradlin) had taken care of them and moved them to the main facility in the Russellville office,” he said. “Nobody had contacted anybody about it until I heard from the guy who won the bid.”

Roberts said he did an online search for Spradlin’s name after seeing it listed next to the delinquent unit when the unit’s auction was advertised in a TimesDaily’s classified ad. He obtained Spradlin’s number and called him, hoping Spradlin would retrieve the records.

“He told me he was already storing files from that company from when he was working with them and that he didn’t think he had any more responsibility toward it, but that if I got in a pickle he would send somebody,” Roberts said. “But then he stopped answering my calls.”

Repeated efforts to contact Spradlin were unsuccessful.

It is unclear why payments were stopped at the storage facility.

Roberts said Spradlin gave him Vickery’s name and number. Vickery said he was out of town when Roberts contacted him, though he planned to retrieve the records Thursday afternoon to move them to the Russellville facility.

According to the Alabama State Board of Medical Examiners’ rules and regulations for storing medical records, if a “physician retires, terminates or otherwise leaves a medical practice, he or she is responsible for ensuring that active patients receive reasonable notification and are given the opportunity to arrange for the transfer of their medical records.”

This is to ensure that patients still have access to their records, officials at the Department of Human and Health Services said.

Larry Dixon, state Board of Medical Examiners executive director, said he could only speak in generalities regarding Digital Diagnostic Imaging’s situation, but more than likely the records belonged to the company — not the physicians who practiced there.

When that’s the case and the company is closing, patients should be called and informed of a date, time and location where they can pick up their records if they so choose, Dixon said.

“I know of no legal requirement after you have offered to return the medical records or given them to the patients to take somewhere else — no possible legal ramifications after a certain amount of time,” Dixon said. “All the Board of Medical Examiners requires is that you keep your medical records as long as medically or legally necessary, and (it) requires that you attempt to return them to patients.”

Vickery said the company did not schedule a time and date to return records to patients, but that was because they were never unavailable to patients, just the patients’ primary care physicians. The records in the storage facility are used for billing purposes only, he said.

Companies and physicians are within their rights to keep copies of medical records and are allowed to charge patients a set copy fee to obtain those records, Dixon said.

He said if he had been in Roberts’ position, he would have destroyed the boxes.

“I would not want even four boxes of medical records in my possession,” he said. “The man who owns them now didn’t generate them, they don’t apply to him, the owner didn’t make any attempt to pick them up in the last two years, and I’d just have them destroyed.”

Roberts said he didn’t destroy the boxes because he thought under the Health Insurance Portability and Accountability Act, or HIPAA laws, records had to be kept for a certain number of years. He also said he was afraid to put them in a Dumpster for fear someone would steal Social Security numbers.

Susan McAndrew, deputy director of Health Information Privacy at the Department of Human and Health Services Office for Civil Rights, agreed with Roberts: Putting records in the trash would have been ill advised, she said.

“The HIPAA Privacy Rule requires that covered entities develop and apply policies and procedures for appropriate administrative, technical and physical safeguards to protect the privacy of protected health information, including through final disposition,” she wrote in an email. “Covered entities are not permitted to simply abandon (protected health information) or dispose of it in Dumpsters or other containers that are accessible by the public or other unauthorized persons.

“For instance, the disposal of certain types of (protected health information) such as name, Social Security number, driver’s license number, debit or credit card number, diagnosis, treatment information or other sensitive information may warrant more care due to the risk that inappropriate access to this information may result in identity theft, employment or other discrimination, or harm to an individual’s reputation,” she added.

As of Saturday, Roberts said he no longer owns the records. Climate Guard Self Storage allows five days for auction winners to clean out the units, which Roberts did not do, Manager Kevin Sledge said.

Sledge said storage facility personnel had not gone through the boxes before the auction.

“Units are auctioned as is because the defaulted customer is allowed to come in and pay up on the day of the auction,” Sledge said.

by Hannah Mask, Times Daily
[email protected]