CROWN POINT | Medical tests. Copies of Social Security cards, driver's licenses and health insurance cards. Names, addresses, phone numbers, blood types. Credit card numbers with expiration dates and security codes.
The most intimate personal details of dozens of Northwest Indiana residents' lives, carelessly discarded into a dumpster in the back of a Crown Point strip mall where anyone who happened to be walking by could see.
If it hadn't been for a nearby restaurant employee who happened to be taking out the trash sometime after the records were dumped, who knows what might have become of them? After his discovery, the man tipped off The Times Media Co., which turned the records over to the Indiana attorney general's office.
The records belonged to patients of My Fast Lab, also known as myfastlab.com, a now-defunct Crown Point medical-testing business that offered a variety of health screenings for "70 percent less" than its competitors. On its website, My Fast Lab purported to have more than 2,000 locations across the U.S., though its only physical location was at 1178 E. Summit St. in Crown Point. The rest belonged to Quest Diagnostics, which My Fast Lab reportedly contracted with.
The business was opened in January 2013 by then-Cedar Lake resident Barry Walker, according to the Lake County Recorder's Office. Walker now lives in Valparaiso.
The approximately 170 records that were recovered included testing records for everything from diabetes and cholesterol to paternity, drugs and sexually transmitted diseases. The ages of the patients ranged from 12 to 97 years old; a few were even residents of a Crown Point nursing home.
A chance occurrence
Adam Mitchell said he was taking out the trash one day for his employer, a pizza place that shared a dumpster with My Fast Lab.
Mitchell, 19, sometimes looks for items of value in the receptacle, because it's also used by a nearby storage facility. That day, he noticed a digital printer, two blood centrifuges and medical-testing supplies. Something else caught his eye: dozens of medical files.
Though he's no health-privacy expert, he knew people's personal and medical information didn't belong in an open dumpster. He retrieved about half the documents; the rest had been sullied by food and liquid tossed in there by a bar also at the strip mall.
He grabbed everything and brought it home, not quite knowing what to do with it. He called the first number he saw, belonging to a Crown Point businessman, who was upset by the revelation but provided no further guidance. Eventually, Mitchell's girlfriend's mother, a nurse, encouraged him to contact the newspaper.
"Someone's life is on that paper," Mitchell said, showing a Times reporter and photographer the documents on a recent day.
"It could have fallen into the wrong hands."
The papers included copies of Social Security cards, driver's licenses, insurance cards, Medicare and Medicaid cards, voter registration cards. There were written prescriptions for lab work, lab results and medical diagnoses.
The federal Health Insurance Portability and Accountability Act of 1996 requires that patient health information kept on paper records be shredded, burned, pulped or pulverized so the information is "rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed," the U.S. Department of Health and Human Services' website states.
"Covered entities are not permitted to simply abandon or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons."
My Fast Lab was what's known as a "draw station," where patients have their blood drawn and the samples get sent to a large-scale laboratory, which then returns the results to the patient's physician. These businesses essentially act as a blood-testing middleman, earning "draw fees" from the actual labs.
The attraction for patients is the convenience of the locations as well as the low price, which is a result of the companies' independence, low overhead and not being associated with large health systems.
The recovered packets were stapled with a My Fast Lab cover sheet, which included each patient's name, address, phone number, email, blood type and emergency contact.
They also had a form with a section initialed by each client that read: "I ... understand and agree that the services provided me by or through myfastlab.com, and the results of my tests, will be maintained as confidential, protected health information, by myfastlab.com as required as federal and state law."
The bottom of each receipt said, "Tell a Friend! You Just Might Save a Life."
"I want to let people know this is going on," Mitchell said. "I don't want this s--- happening to me."
The Crown Point businessman, who spoke on the condition of anonymity, said after Mitchell called, he went to My Fast Lab because he needed to get his blood work done again and wanted to ask the business it they would just dump his records into the trash.
But the office was empty and had a "For Lease" sign on the window.
A decal reading "myfastlab.com: lab tests 70% less" was still on the wall.
"I was disturbed because when you go to a place like that and get your blood drawn, you think everything's going to be confidential," said the man, who started going to My Fast Lab because he wanted to support another local business. "That level and trust was disturbed and broken after that."
'Oh my gosh'
Four of the seven folders recovered were labeled with the name of Crown Point-based Cardiac Care Associates. The clinic's manager, Cheryl Agent, said it used to send patients to My Fast Lab for a type of cholesterol test.
When told about the documents being found in a dumpster, she said: "Oh my gosh. ... I just can't imagine. You hear about this stuff and think, who in this day in age would do something like that? Buy a stinking shredder!"
She said her practice long ago ceased doing business with My Fast Lab because it had so many issues with the draw station, notably that it would ask patients for money above what they were supposed to be charged.
"They gave our patients such a hard time," Agent said. "We got fed up with it and just said, 'We're going to find someplace else.' "
A representative of a laboratory that did testing for My Fast Lab, who spoke on the condition of anonymity because he didn't want to jeopardize his employment, said his company severed its relationship with the draw station after finding out it was "double-dipping."
As he explained it, his employer had an agreement to test samples drawn by My Fast Lab. The company would then pay My Fast Lab a "draw fee" before billing the patient's insurance for the actual testing. But he claimed My Fast Lab would charge patients after drawing the blood when they should have paid nothing upfront.
"It's fraud," the rep asserted. "But if you've got some little old lady coming in and you tell her it's $25, how does she know insurance is paying on the back end?"
But even given his previous dealings with My Fast Lab, the rep said he was caught off guard about the documents in the dumpster. "That part of it would have surprised me," he said.
"If you're burning yourself on a daily basis, why burn yourself in the end, too?"
History of record dumping
Joan Antokol, an Indianapolis attorney who specializes in privacy, said a provider that improperly disposes of medical records would be violating both state and federal laws, and open itself up to lawsuits from patients.
She said these types of incidents seem to be on the decline, but still occur enough to make the average patient wary.
Earlier this year, Indiana's attorney general settled for $12,000 with former dentist Joseph Beck for violating HIPAA privacy laws, the first such fine of its kind in the state. Beck had been accused of improperly discarding thousands of patient records, which had been found in an Indianapolis dumpster in 2013.
"It's sad that it's still happening," Antokol said.
"People aren't taking proper precautions when they're disposing of records. Or they throw away computers or electronic devices with data on them that can still be identifiable."
Mitchell said the digital printer he found among the records and medical supplies appeared to have had its hard drive removed.
Jeffrey Cicillian, 56, a retired Lake County Sheriff's Department employee, was among those whose records were found in the dumpster.
"That's a huge HIPAA violation," he said.
Cicillian, of Crown Point, said he went to the storefront testing center because it was cheaper than going to the local hospital.
"You live and you learn," he said.
For the second part of this story, click here.