Case closed in dumping of VA files, but worries, questions remain

A federal investigation confirmed what private security guard and whistle-blower Andrew Martin-Smith told Rep. Jon Porter in February. Yes, confidential patient and personnel files were dumped in the trash bin behind the Department of Veterans Affairs' West Clinic at 630 Rancho Drive. The reason: human error.

Guess that sounds better than human stupidity.

Without criminal intent, the U.S. attorney's office declined prosecution. Case closed.

Much of what was in the Department of Veterans Affairs inspector general's report was a rehash of what I had reported in February. Since January, the VA was supposed to shred all documents. But apparently Richard Brisard, chief of clinical support for the VA Southern Nevada Healthcare System, didn't read that memo.

Brisard's the guy who, after a cursory review, on Feb. 6 asked a housekeeper to dump old files, unaware that the files included sensitive information relating to patients, employees and contractors.

That was human error and clearly negligent, the report said.

"Since VA has taken appropriate administrative action, we are not recommending further administrative action against any individual," the inspector general's report said.

Because it's a personnel issue, the government won't say what disciplinary action, if any, was taken against Brisard, but he's still working there.

The inspector general's rundown of what had been trashed and recovered is jaw-dropping. The information recovered included the names of 3,375 people, 1,191 Social Security numbers, 461 dates of birth, 1,085 instances of patient medical information, such as prescriptions and medical diagnoses, 442 other instances involving confidential and protected information pertaining to resolution of employee disputes and 1,769 pages that revealed proprietary pricing information associated with numerous bids for VA contracts.

If you had anything to do with the VA West Clinic, there's a chance your stuff was dumped.

And what has never been explained, and will never be known, is how much more information was hauled away and never recovered.

Porter was told of the cavalier treatment of VA records by Martin-Smith, who said Wednesday that his bosses since have been on the lookout for any misstep by him. He thinks his job is "most definitely" in jeopardy and described his work environment as hostile.

Martin-Smith tried to stop the housekeeper from dumping obviously sensitive records, and when he couldn't do that, he reported the problem to his bosses at the security firm.They asked him to try to recover some of the records. He said they were in two trash bins.

One problem the inspector general uncovered: The security company didn't notify anyone with the VA for 16 hours. In fact, Security Manager Mike Potocki told his subordinates not to notify VA managers and failed to take immediate action to recover the documents. Potocki told the inspector general investigators his company was "not officially required to stop material from leaving the building."

One would think that in this era of identity theft, common sense might prevail, but apparently not.

The inspector general's report recommended that the security company needs a new contract, so it can be held accountable for its actions.

Porter isn't happy with the report, calling it "a typical bureaucratic answer."

"This isn't over, it's just the beginning," he said Wednesday from Carson City.

He still has concerns about the security company, RAMCOR, because a supervisor asked Martin-Smith to change his report and because of the 16-hour delay in telling the VA what had happened.

Officials at the Southern Nevada VA office didn't return calls Wednesday, but they can't be pleased about the report.

The VA is not exempt from federal violations of the Health Insurance Portability and Accountability Act of 1996, which established rules to guard the privacy of medical records and has both civil and criminal penalties.

Porter said federal legislation might be required to address some of the issues raised in this case because he believes the same problems in Las Vegas with security and information protection could exist nationwide, including "huge gaps" in the security process.

Like not knowing whether it's your job to stop records from being dumped instead of shredded.

The old saw is that you can't legislate against stupidity.

Porter apparently is going to try.

Jane Ann Morrison's column appears Monday, Thursday and Saturday. E-mail her at Jane@reviewjournal.com or call 383-0275.