Two complications may occur with this finding.

First, the state of Texas has rules on the retention of medical records, and for adult medical care, Texas code states that the records must be retained for “7 years past the last date on which service was given or until the patient’s 21st birthday, whichever occurs later.  (22 TAC 165)”

Since the information found includes abortion records from the past seven years, there is likely a violation of some sort in this finding that the state of Texas should investigate for the sake of the patients in question. Clearly these records have not been safely maintained for patients who may need access to them.

The news station who initially reported the story said:

Our legal analyst says her relative may not actually have broken any HIPAA (Health Insurance Portability and Accountability Act) laws since the records were not shared or disseminated. But he adds that patients have every right to be upset about the possible negligence in handling of these records.

However, based on the wording of HIPAA, it may not be that cut and dry. Unless the owner of the warehouse is a medical professional, or the woman who placed them there was leasing the space for a medical operation, it seems likely that there was a HIPAA violation, as that law states restrictions on disposal of records as well.

The United States Department of Health and Human Services (HHS) says that:

“Shredding or otherwise destroying PHI [protected health information] in paper records so that the PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed prior to it being placed in a dumpster or other trash receptacle.”

Clearly, this was not the case with the discovered abortion records. Additionally, since Cedillo was the one who found them on her property, her access does not seem to be covered by the act, which also notes:

Thus, covered entities are not permitted to simply abandon PHI or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons. However, the Privacy and Security Rules do not require a particular disposal method. Covered entities must review their own circumstances to determine what steps are reasonable to safeguard PHI through disposal, and develop and implement policies and procedures to carry out those steps. In determining what is reasonable, covered entities should assess potential risks to patient privacy, as well as consider such issues as the form, type, and amount of PHI to be disposed.

So far, the reason and methods of disposal have not been established, so it’s too soon to speculate on all the motives and violations behind this discovery, but some of the concern seems clear simply by the requirements in the state of Texas to maintain records, and the requirements of federal laws on records access and disposal.

Meanwhile, thousands of women over a 20-year span probably didn’t expect their records to be found by a stranger and her dog. They are going to have questions, too. The public and medical community can only hope that authorities give such a serious matter their full investigative attention.

Update: On Thursday, KTRK reported that lawyers for the defunct abortion clinic who were collecting the found files rewarded Cedillo. The station reported that “the law firm of Noah Meek issued a reward to the warehouse owner Esmeralda Cedillo. The firm says the reward was for keeping those files confidential.” The story notes that the records would be “returned to patients or destroyed.” However, there have been no reports of any investigations of why the files were allowed to be left in the warehouse or if there was any possibility that they passed through other hands where confidentiality was potentially violated.

First, the state of Texas has rules on the retention of medical records, and for adult medical care, Texas code states that the records must be retained for “7 years past the last date on which service was given or until the patient’s 21st birthday, whichever occurs later.  (22 TAC 165)”

Since the information found includes abortion records from the past seven years, there is likely a violation of some sort in this finding that the state of Texas should investigate for the sake of the patients in question. Clearly these records have not been safely maintained for patients who may need access to them.

The news station who initially reported the story said:

Our legal analyst says her relative may not actually have broken any HIPAA (Health Insurance Portability and Accountability Act) laws since the records were not shared or disseminated. But he adds that patients have every right to be upset about the possible negligence in handling of these records.

However, based on the wording of HIPAA, it may not be that cut and dry. Unless the owner of the warehouse is a medical professional, or the woman who placed them there was leasing the space for a medical operation, it seems likely that there was a HIPAA violation, as that law states restrictions on disposal of records as well.

The United States Department of Health and Human Services (HHS) says that:

“Shredding or otherwise destroying PHI [protected health information] in paper records so that the PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed prior to it being placed in a dumpster or other trash receptacle.”

Clearly, this was not the case with the discovered abortion records. Additionally, since Cedillo was the one who found them on her property, her access does not seem to be covered by the act, which also notes:

Thus, covered entities are not permitted to simply abandon PHI or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons. However, the Privacy and Security Rules do not require a particular disposal method. Covered entities must review their own circumstances to determine what steps are reasonable to safeguard PHI through disposal, and develop and implement policies and procedures to carry out those steps. In determining what is reasonable, covered entities should assess potential risks to patient privacy, as well as consider such issues as the form, type, and amount of PHI to be disposed.

So far, the reason and methods of disposal have not been established, so it’s too soon to speculate on all the motives and violations behind this discovery, but some of the concern seems clear simply by the requirements in the state of Texas to maintain records, and the requirements of federal laws on records access and disposal.

Meanwhile, thousands of women over a 20-year span probably didn’t expect their records to be found by a stranger and her dog. They are going to have questions, too. The public and medical community can only hope that authorities give such a serious matter their full investigative attention.

Update: On Thursday, KTRK reported that lawyers for the defunct abortion clinic who were collecting the found files rewarded Cedillo. The station reported that “the law firm of Noah Meek issued a reward to the warehouse owner Esmeralda Cedillo. The firm says the reward was for keeping those files confidential.” The story notes that the records would be “returned to patients or destroyed.” However, there have been no reports of any investigations of why the files were allowed to be left in the warehouse or if there was any possibility that they passed through other hands where confidentiality was potentially violated.

Preemie born at 26 weeks ‘defied the odds’ after battle with sepsis