Patient Data Posted Online in Major Breach of Privacy

By Kevin Sack
The New York Times

Published September 9, 2011

A medical privacy breach led to the public posting on a commercial Web site of data for 20,000 emergency room patients at Stanford Hospital in Palo Alto, Calif., including names and diagnosis codes, the hospital has confirmed. The information stayed online for nearly a year.

Since discovering the breach last month, the hospital has been investigating how a detailed spreadsheet made its way from one of its vendors, a billing contractor identified as Multi-Specialty Collection Services, to a Web site called Student of Fortune, which allows students to solicit paid assistance with their schoolwork.

Gary Migdol, a spokesman for Stanford Hospital and Clinics, said the spreadsheet first appeared on the site on Sept. 9, 2010, as an attachment to a question about how to convert the data into a bar graph.

Although medical security breaches are not uncommon, the Stanford breach was notable for the length of time that the data remained publicly available without detection.

Even as government regulators strengthen oversight by requiring public reporting of breaches and imposing heavy fines, experts on medical security said the Stanford breach spotlighted the persistent vulnerability posed by legions of outside contractors that gain access to private data.

The spreadsheet included names, diagnosis codes, account numbers, admission and discharge dates, and billing charges for patients seen at Stanford Hospital’s emergency room during a six-month period in 2009, Mr. Migdol said. It did not include Social Security numbers, birth dates, credit-card numbers or other information used to perpetrate identity theft, he said, but the hospital is offering free identity protection services to affected patients.

The breach was discovered by a patient and reported to the hospital on Aug. 22, according to a letter written four days later to affected patients by Diane Meyer, Stanford Hospital’s chief privacy officer. The hospital took “aggressive steps,” and the Web site removed the post the next day, Ms. Meyer wrote. It also notified state and federal agencies, Mr. Migdol said.

“It is clearly disturbing when this information gets public,” he said. “It is our intent 100 percent of the time to keep this information confidential and private, and we work hard every day to ensure that.”

Diane Dobson, of Santa Clara, Calif., said her “jaw dropped” on Saturday when she intercepted the letter from Ms. Meyer addressed to her 21-year-old son, who she said had received emergency psychiatric treatment at Stanford in 2009. Ms. Dobson said it could have been disastrous if her son, who lives at home, had learned that his name was linked to a mental health diagnosis.

“My son, I can tell you, is fragile and confused enough that this would have sent him over the edge,” Ms. Dobson said, saying she decided to speak publicly now because of her frustration with the breach. “Everyone with an electronic medical record is at risk, and that means everyone.”

The entire story can be read here.

Info dump yields $40K settlement

By Bryan Cohen
Legal Newsline

North Carolina Attorney General Roy Cooper announced on Wednesday that a Charlotte doctor has paid $40,000 for allegedly dumping files that contained patients' financial and medical information. 

Dr. Ervin Batchelor owns and operates the Carolina Center for Development and Rehabilitation, which is a psychological testing and treatment facility located in Charlotte. In June 2010, the facility allegedly disposed of 1,000 patient files illegally by dumping them at the West Mecklenburg Recycling Center.

The files allegedly contained health information, insurance account numbers, drivers' license numbers, Social Security numbers, dates of birth, addresses and names for 1,600 people.

"Any business you entrust with your information has a duty to keep it safe," Cooper said. "Sensitive financial and health information should never be carelessly dumped, putting customers and patients at risk of identity theft."

Under a state law Cooper pushed through the General Assembly in 2005, businesses that dispose of records containing personal identifying information must destroy or shred those records so that identity thieves can't retrieve information from discarded files that have been carelessly thrown away. Medical records also face added restrictions under federal health privacy laws.

The Carolina Center records were recovered by Mecklenburg County, N.C., officials, who contacted Cooper's office.

As part of a settlement, Batchelor paid $40,000 and agreed to abide by both federal and state laws that protect people's personal financial and health information.

The Carolina Center has already notified the patients whose information was placed at risk. State law requires businesses, as well as state and local government agencies, to notify consumers if a security breach may have put their personal information at risk. The breaches of security must also be reported to the Consumer Protection Division. Since state laws on security breaches took effect in 2005 and 2006, a total of 889 breaches involving information and more than 3.3 million state consumers have been reported.

Cooper's CPD has won settlements in multiple other document dumping cases, including against a Gastonia, N.C., movie rental store, two mortgage lenders from the Charlotte area and a Greensboro, N.C., urgent care clinic.

Providence police, hospitals at odds in medical privacy debate

By Amanda Milkovitz
Rhode Island News

A judge in a murder trial in June wanted to see the medical records of a woman whose husband was charged with killing her.

Rhode Island Hospital’s records department rejected the court order –– and answered the subsequent subpoena by saying the law allowed 20 days to respond.

A Providence detective investigating an alleged murder requested the medical records of the victim, who died at Rhode Island Hospital. In his request for the records in March 2010 — nearly two years after the death –– the detective included a copy of the victim’s death certificate, plus two signed releases from the man’s father and adult son.

Rhode Island Hospital refused.

In March, the Providence police wanted to know if a man who’d been shot was still alive, before the suspect accused of shooting him was released on bail. If the victim was dead, the suspect would be held for murder.

Rhode Island Hospital wouldn’t say whether the wounded man existed.

Providence Detective Sgt. James Marsland sighs in frustration as he tells these stories.

“We call over to the hospital to find out his condition: Is he dead or alive? That’s the only medical information I want.

“They wouldn’t tell me he was there,” Marsland said. “I know he’s there –– we brought him there.”

The federal Health Insurance Portability and Accountability Act, known as HIPAA, was designed to protect the privacy of medical databases and imposes hefty fines against those who release patients’ protected information. Even so, the federal law allows the release of some information to law enforcement, such as when the police need to identify a suspect, fugitive or material witness, or when the police are investigating whether a patient is a victim of a crime.

States have their own versions of patient privacy laws, and Rhode Island’s Health Care Confidentiality Law, written in 1978 and adapted over the years, is even more restrictive than the federal law.

The state’s law requires health-care providers to release information to law enforcement about specific kinds of cases, including those involving gunshots and abuse of children — but otherwise, providers need the consent of the patient or family to release any information. Violators may be punished by a fine of up to $5,000 or six months in prison.

Dr. John B. Murphy, senior vice president for medical affairs at Rhode Island Hospital, said in an interview that the hospital wants to work with the police, but it also must follow the law. He’s participated in meetings with the Providence police about the issue, most recently with then-Chief Dean M. Esserman a few months ago, and said the hospital has been trying to accommodate investigators.

The hospital has recently stopped concealing the identities of all people brought in with violent injuries, Murphy said. The hospital also gave police contact information for the top on-call administrator.

But there is only so much the hospital can do within the law, he said.

“If you think the law needs to be changed, then change the law,” Murphy said. “Why does the law differentiate from a grazing gunshot that just needs a Band-Aid and a life-threatening stab to the liver?”

The rest of the story can be found here.

A High Risk Situation: The Suicidal Client

Gary Schoener

From our experience, psychologists and students frequently look for excellent resources for dealing with suicidal patients.  Working with suicidal patients can become time intensive and emotionally draining.  Psychologists need to become educated and remain current with their training.  Consulting with other psychologists when dealing with at-risk patients is always recommended.



Gary Schoener, noted ethics educator, permitted our committee to post this resource when dealing with suicidal patients.

Suicide Handout

Why Therapist Directories Are A Waste Of Time

by Mike Langolis
Gamer Therapist
Psychotherapy Meets Web 2.0

This post is for all of you who have been considering or actively using listings in therapist directories.  I frequently get asked from consultees which directories they should list in.  I also frequently see colleagues debating on bulletin boards and listservs the merits and demerits of individual directories.  So I figure it’s time to offer you my perspective.  Please bear in mind that I am sharing my experience and opinions here, and if you’ve had a different one, hopefully you’ll mention it on the comments.  If you own a directory service, I hope you’ll disclose that as well.

When I started building my practice, I had a lot of time to spend filling out various online directories.  I literally spent hours filling out profiles that promised to make me visible to potential patients.  To be fair it gave me the opportunity to hone my bio and elevator speech, but other than that I now think that I was wasting my time.  But let’s talk a little about why directories may be a waste of your time, because I think it points to a larger misconception about marketing your practice online.

Billboard in a bottle.

Many therapists still approach the internet as if it was a giant Yellow Pages.  We often create static content, the equivalent of a business card, cover letter and resume, and then slap it up on a website, or a directory.  Then we sit back and wait for the phone to ring.  It’s like we imagine that we created a giant billboard and threw it into the world wide web.  But in reality, it’s more like a message in a bottle, thrown in a vast ocean.  We imagine that that will get us recognized.  It usually doesn’t, and here’s why.

If you google “find a therapist” you will literally find dozens of website directories guaranteed to help patients find the right provider.  If you’re ambitious you could spend hours and days finding all of them and entering your information.  Many of them are free, some charge money, and a few don’t let you know whether they will charge or not until you’ve entered all of your information.  One of the main problems with directories is exactly that there are so many of them.

One thing I’ve learned from starting up social networks for other companies is that you always need a critical mass of members as quickly as possible.  If you launch a site you have a few days to a week to achieve this in most cases.  Otherwise potential members will log in to your site, look around and see little activity, and leave.  So low enrollment of providers in a directory will drive little traffic to it.

On the other hand, if you take a directory like Psychology Today’s you will see that they did achieve a critical mass, and have more traffic.  But the problem here is that this is because every therapist and her maiden aunt is now listed there.  So the problem becomes how to set yourself apart from the rest.  If you are determined to spend time on listing yourself in a directory, I’d suggest that you pay for the PT one and try to distinguish yourself as best you can.  In fact, the Psychology Today site is the only directory I even try to keep current and pay for anymore.

The entire blog post can be found here.

Harford child psychologist pleads guilty to abusing 3 girls

By Mary Gail Hare
The Baltimore Sun
August 22, 2011

A Harford County child psychologist pleaded guilty Monday to child abuse and sexual assault of three young girls he had been treating at his Fallston office.

David Wayne Schrumpf, 55, of Whiteford will serve six years in prison, where he will undergo sex offender treatment, under terms of a plea agreement filed in Harford County Circuit Court. He is charged with one count of child sex abuse and two counts of second-degree assault.

Schrumpf will be required to register as a sex offender for the rest of his life. He must also surrender his license to practice psychology and cannot seek another in any jurisdiction, according to the plea agreement.

The charges arose after one 7-year-old girl reported to her mother that Schrumpf had touched her inappropriately during a session at his office. Two other victims, who were 9 and 10 years old at the time of the abuse, came forward during the investigation, county State's Attorney Joseph I. Cassilly said. All the incidents occurred at Schrumpf's office in Fallston over a year beginning in October 2009, Cassilly said.

Sentencing is scheduled for Oct. 31 in Harford County Circuit Court before Judge Maurice Baldwin.

     *     *     *     *     *     *     *     *     *

Local Psychologist Arrested on Child Sex Charges
By Collin Hoofnagle, News Editor
The Patriot, John Carroll's Online Student Newspaper
December 9, 2010

In a Dec. 8 email to parents, Principal Paul Barker said that an area psychologist used by students was recently arrested on child sex charges.

According to “The Aegis,” David W. Schrumpf is a licensed psychologist with a practice in Fallston. He was charged Friday, Dec. 3, with 10 counts of third-degree sex offense and 10 counts of sex abuse of a minor.

According to the Aegis, a local woman was discussing appropriate touching with her seven-year-old daughter when the daughter mentioned her psychologist. The mother then talked to her 10 year-old daughter, who is also a patient of Strumpf’s, when the daughter said that Strumpf touches her in private places during sessions.

In the email, Barker said, “While John Carroll has no formal connection with Dr. Schrumpf, we are aware that over the years some of our students have used Dr. Schrumpf’s services for ADHD diagnostic testing or for counseling.”

NIH Finalizes Financial Conflict of Interest Rules

By Brian Vastag

The Washington Post

Published: August 23

The National Institutes of Health has finalized rules to reduce financial conflicts of interests among federally funded researchers who also receive payments or stock from drug and medical device companies.

The rules, which will affect more than 40,000 researchers, come after a string of high profile cases in which federally funded researchers failed to disclose millions of dollars from companies with a financial interest in the outcome of their work.

Researchers who receive more than $5,000 in income from drug or device companies must disclose the payments. Universities or other institutions employing the researchers must collect the data and provide for public access to it.

But in an about-face from proposed rules announced last year, institutions will not be forced to disclose conflict-of-interest information online. (See our prior blog post).  Instead, they may maintain the data offline and provide it only when requested.

This change reduces the administrative burden of the proposed public disclosure rule for institutions employing federally funded researchers, said Sally Rockey, the NIH’s deputy director for extramural research.

Universities also will be required to develop plans to manage the financial conflicts of individual researchers, but the plans do not have to be made public.

Praising the “vast majority of researchers” as ethical and sensitive to conflicts of interest, NIH Director Francis S. Collins called the new rules “an insurance plan against potential trouble downstream.”

Collins added that the rules will ensure that government-funded researchers can continue working with private companies.

The rest of the story can be read here.

Team Decisions Better for the Weary

by Robert Preidt
MedicineNet.com

Teamwork can help tired people avoid making poor decisions, a new study indicates.

Pilots, doctors and others in demanding professions can make dangerous errors when they're weary. But, fatigued people who work as a team have better problem-solving skills than those who work alone, British researchers report.

They asked 171 army officer cadets, aged 18 to 24, at a weekend training exercise to solve a series of math problems. Some were tested before they began the training session and were rested, while others did the math problems at the end of the weekend when they were exhausted.

Individual cadets who were fatigued did far worse on the tests than those who were rested. However, teams of exhausted cadets did just as well as teams of rested cadets.

The study appears online in the Journal of Experimental Psychology: Applied.

"Teams appear to be more highly motivated to perform well, and team members can compare solutions to reach the best decision when they are fatigued. This appears to allow teams to avoid the inflexible thinking experienced by fatigued individuals," study author Daniel Frings, a senior lecturer in social psychology at London South Bank University, said in a journal news release.

In situations where fatigue is a concern, decisions should be made by teams rather than individuals if possible, the study concluded.

     +     +     +     +     +     +     +     +

This research supports the idea that group consultation can be very helpful for tired and overworked psychologists, especially when working with high risk or clinically challenging patients.

Vignette 5: A Tricky Situation

Dr. Smith is a psychologist who has worked with a young woman for about 9 months. The patient presents with a history of rejection and abandonment as well as persons of power misusing her. She recently received an offer to become a sales representative for a pharmaceutical company. The psychologist and patient discussed the type of job she was entering because she may experience rejection from doctors, nurses, and other office personnel.

After her 6 weeks of training, the company assigns her to a regional director that the psychologist knows personally. Along with the initial anxiety of the new job, her territory, and her boss, she reports a fear of failure and other anxiety related symptoms. The psychologist knows her new boss, Mr. Biggy. The psychologist seeks to reassure the patient that he, the psychologist, knows Mr. Biggy on a personal basis and that “he is a really a good guy” that seems bright, friendly, and fair. He indicates that Mr. Biggy is a good “family man”. The patient is reassured, and reported less anxiety. In actuality, Mr. Biggy’s wife is a very close friend of Dr. Smith’s wife. They have dinner as couples several times per year.

Several weeks into going on sales calls, your patient reports that Mr. Biggy is complimenting her on the way she looks and her ability to make the sale. They start spending more time together. However, she begins to feel uncomfortable as she feels like they are spending too much time together. Mr. Biggy starts asking questions that are more personal, forwards her “funny” emails, and texts some inappropriate remarks to her, mainly about her alluring power that helps make sales.

Mr. Biggy and Dr. Smith meet in an unplanned social venue. Mr. Biggy pulls Dr. Smith aside and explains how he has become very attracted to a new sales representative. He thinks that she is young and impressionable. He confides that he would like to have an affair with her.

Dr. Smith politely explains that he feels uncomfortable with them discussing his more personal marital issues. Mr. Biggy indicates that he wants to talk more about his feelings. Dr. Smith suggests a referral to a psychologist, but Mr. Biggy states that he feels more comfortable talking with Dr. Smith. After some other small talk, Dr. Smith leaves to mingle with other friends.

Dr. Smith is now worried about the entire situation.

In hindsight, what triggered some possible difficulties in this situation?

What are the ethical issues involved in this scenario?

How are the client’s emotional and interpersonal issues related to the psychologist’s dilemma?

What are the options for the psychologist for both his relationship with his patient and his relationship with Mr. Biggy?