Providers May Be Careless When Disposing of Paper Records, Study Shows

Norra MacReady

March 20, 2018

As healthcare providers move from paper to electronic records, tons of paper records are being thrown out. A new study finds, however, that hospitals and physicians' offices sometimes recycle rather than destroy documents containing patients' sensitive information.

Medical reports, clinical notes, and summaries were most likely to be inappropriately discarded, Joshua Kapil Ramjist, MD, and colleagues from the Department of Surgery at the University of Toronto in Ontario, Canada, write in an article published today in JAMA.

The findings suggest that "potential privacy breaches are not isolated, but should be expected in locations where patient information is printed and there is an option for nonconfidential paper disposal," they warn.

Between November 2014 and May 2016, the authors conducted a recycling audit of 5 teaching hospitals in Toronto. Each hospital had recycling bins for paper disposal as well as "secure shredding receptacles" for confidential paper records.

The recycled material was collected at least 3 times per week over 4 weeks at each site, classified according to the hospital location from which it came (inpatient ward, outpatient clinic, etc), and weighed. In total, the team collected 591.6 kg of material, which included 2687 items of personally identifiable information.

Among this recovered material were 1885 documents contained medium- or high-sensitivity personal health information. Physician offices were the worst offenders, with 1243 items, followed by 265 items from inpatient wards.

When calculated by weight, physician offices were still the most common offenders, improperly disposing of 15.79 items/kg material. Emergency departments came in second, with 5.68 items/kg.

Clinical notes, summaries, and medical reports were among the personally identifiable documents most likely to be recovered from physician offices and from inpatient wards, although billing forms, labels and patient identifiers, and requests and communications also were frequently found.

These findings suggest that "migration to the EHR may have heightened risks of other privacy breaches," Ramjist and coauthors write. For example, when paper charts are no longer necessary, "the potential for improper disposal of printed patient information may paradoxically increase."

Hospitals and other healthcare institutions should consider eliminating any alternatives to nonconfidential disposal of paper documents, regardless of content, as "an effective, albeit expensive strategy to reduce the risks of paper-based privacy breaches," they conclude. "Minimizing the printing of documents containing [personal health information] would be a complementary approach."

The issue can become a legal one, cautions senior author Nancy Baxter, MD, PhD, chief of general surgery at St. Michael's Hospital at the University of Toronto. "Patients have a right to expected safekeeping of personal information," Baxter said in a hospital press release. "In many jurisdictions, including the province of Ontario, protection of personal health information is codified in legislation."

The authors have disclosed no relevant financial relationships.

JAMA. 2018;319:1162-1163. Abstract

For more news, join us on Facebook and Twitter


Comments on Medscape are moderated and should be professional in tone and on topic. You must declare any conflicts of interest related to your comments and responses. Please see our Commenting Guide for further information. We reserve the right to remove posts at our sole discretion.