Sonya Hooks was putting her junk papers into a bin at a popular recycling center on a recent Sunday in Decatur, when she couldn’t believe what she saw inside: Documents with names, phone numbers, a photocopied driver’s license, and Social Security numbers.
“I was just in shock,” Hooks said, noting the paperwork was related to services for senior citizens. “And they’re the most vulnerable... Somebody can take this information and come to some elderly person’s house and take advantage of them.”
Privacy experts say both federal and Georgia laws were almost certainly violated when the records were discarded. No local or state government or agency has taken responsibility for the documents.
Under federal law, whoever is responsible for dumping the documents improperly can be fined up to $50,000 per violation, and each victim could be counted as a violation.
The papers were left in the paper recycling bin at the Your DeKalb Farmers Market, which is open to the general public. To recycle paper, people climb a stepladder to reach a window at the top of a dumpster, where they find themselves looking inside.
The pages Hooks found there, often photocopies, have letterhead from a variety of organizations and are dated from 2006 to 2016.
A DeKalb County Board of Health Form reports the medical history for a person, perhaps a job applicant. A resume and photocopies of identification cards have no letterhead. A Georgia Department of Community Health form presents a Georgia Nurse Aide Registry certificate. An Emory Healthcare form presents a passing drug test. A Fulton County form requests services for a person with dementia who needs help with grooming and getting in and out of the tub.
The most common letterhead is from “Senior Connections,” found on documents ranging from personnel forms to daily activity logs listing how much assistance a particular senior citizen required on which days. Senior Connections was a nonprofit organization that contracted with government agencies to provide senior services in the Atlanta area until it shut down in 2018.
Senior Connections was first set up in the 1970s to fill a gap in DeKalb County services for seniors. In the beginning it contracted with the Atlanta Regional Commission to do that work. According to the ARC, which operates the Area Agency on Aging, Senior Connections was licensed through the state DCH as a private home care provider. From 2003 to 2018, Senior Connections contracted with DeKalb County to do such work, according to DeKalb.
Contacted by The Atlanta Journal-Constitution, those governments all said they had policies requiring proper protection and disposal of private documents, as mandated by the state.
Most also said they also said they had no knowledge of the documents. DeKalb County, however, said that when Senior Connections shut down, it transferred documents to DeKalb, and the county currently has those documents safely stored in its Office of Aging. None of the documents found in the dumpster can be verified as documents belonging to DeKalb County, it noted.
Carol Amick, director of health care services at CompliancePoint, based in Duluth, guides health care companies in managing confidential documents. Under the federal health privacy law, HIPAA, Amick said, the documents with private health information needed to be shielded from public view, even if they were still in the offices of an agency.
When disposed of, it would have been okay if they were shredded and impossible to read, she said. But leaving them intact in the public dumpster violated the law.
“In this case, they should have been shredded in such a way that nothing could be identified,” Amick said. “You’re still liable for that even after you go out of business.”
David Katz, an Atlanta-based attorney on cybersecurity and privacy, said non-medical private documents such as driver’s licenses and Social Security numbers are protected too, under state law. The attorney general’s office has the authority to investigate potential violations whether they involve medical or other private information.
Amick and Katz agreed that the incident demonstrates that people should remain vigilant about their data, even if organizations they’ve given it to no longer exist. People can order credit monitoring in order to track whether anyone is opening new accounts in their name.
But the most important protection they have is for organizations to follow the law and the government to enforce it.
“It’s really hard to protect yourself from someone doing something like this,” Amick said.
Genise Barber, a resident of Fulton County, received help from Senior Connections in 2013. Her records were among those found in the dumpster.
Several years ago Barber applied for assistance with home repairs and Senior Connections arranged for the repairs.
Now, those documents were exposed containing her phone number, address and that she was a senior. “I’m mad. I’m mad about that,” said Barber, when reached at the phone number on the documents. “That shouldn’t be.”
Feeling a sense of outrage, Hooks, who studied journalism, has worked in film and is working on an unrelated freelance documentary, took the documents out of the dumpster so no one could use them for scams. She turned them over to the AJC and its attorneys.
“It looked,” Hooks said, “as if someone had started shredding, they got tired, and they’re like, ‘Oh, I don’t want to do this anymore. Let me just take it to the Farmers Market and get rid of it.’”
SAFEGUARDING THE DOCUMENTS
The person who initially found the documents removed all she could reach inside the recycling bin, determined to either shred them herself or turn them over to a watchdog for safe disposal. She delivered them to The Atlanta Journal-Constitution, which is placing the documents in the custody of its attorneys for safekeeping. It’s not clear how many documents remained inside the bin, but they were eventually covered up by other piles of paper.
PRIVATE DATA
The federal health privacy law HIPAA protects your private health information, but only from misuse by “covered entities” such as health workers.
State law protects private data including Social Security numbers and driver’s license numbers, your financial balances and credit card numbers.
Recourse: After a data breach it’s hard to put the cat back in the bag. Experts advise people to monitor their credit reports for suspicious activity.
About the Author
