Article Reprint From The Hartford Courant
May 14, 1999
Page: D1 Section: BUSINESS Edition: STATEWIDE
Source: KENNETH R. GOSSELIN; Courant Staff Writer

CARELESS DISPOSAL OF RECORDS IMPERILS PRIVACY

PAPER CHASE
A month ago, Aetna health insurance claim forms blew out of a truck on the way to a recycling center and scattered on I-84 in East Hartford during the evening rush hour.
Aetna, the nation's largest health insurer, quickly dispatched employees -- some of them on the way home from work -- to scoop up forms containing names and personal health information.

Two weeks later, Fleet Bank deposit slips flew off a truck traveling to an incinerator, and were found blowing around downtown Bristol. Teams of Fleet workers -- 20 the first day, and 35 the next -- combed much of the route to the incinerator, retrieving 245 slips.

In an age when lawmakers and consumer advocates are raising concerns about who should have access to details about consumer health and finances held in electronic databases, information on old-fashioned paper appears to be just as vulnerable.

Both times, the papers should have been shredded under company policy, but weren't. Both Aetna and Fleet, Connecticut's largest bank, said steps have been taken to ensure that such potential breaches of privacy and confidentiality don't happen again.

Similar incidents have occurred elsewhere in the country, privacy experts say.
``And I suspect it happens more than I hear about it,'' said Evan Hendricks, editor of Privacy Times, a Washington, D.C., newsletter.

The Aetna and Fleet incidents have prompted Connecticut's insurance department to reinstate into its insurance company examinations questions about procedures for disposing of documents with sensitive customer information.

And the House co-chairman of the state legislature's banks committee said he might consider proposing a law next session that would spell out rules for disposing of such documents, one that doesn't exist now.

In the 1990s, personal information has become a key tool in pitching products to consumers. For instance, many large banks have built vast data warehouses with financial profiles of depositors that are used to tailor marketing campaigns for a growing array of products and services.

But let confidential information get into the wrong hands, and there can be real trouble, Hendricks said. "One piece of information and, boom, you're on your way,'' Hendricks said.
Bank deposit slips, for example, often contain the name, address, account number and signature of the account holder -- enough information for someone to at least attempt a fraudulent transaction on the account.

Health insurance claim forms are an even bigger gold mine of personal information, including the Social Security number, the key to a rapidly growing crime-- identity fraud-- according to a report last year released by the federal government.

The Secret Service, for example, reported that arrests for identity fraud -- the act of stealing someone's financial identity and running up debt under the victim's name -- rose from 8,806 in 1995 to 9,455 in 1997, a 7 percent increase. The losses from those cases, however, jumped 68 percent in the same time period, from $442 million in 1995 to $745 million in 1997.

In Connecticut, there are both banking and insurance statutes spelling out how long records with sensitive information must be kept, and who can have access to them.

But there are no specific state laws covering how such documents must be destroyed, state banking and insurance department officials said.

In 1995, the state's commissioners of banking and consumer protection urged banks, securities brokers, mortgage lenders and other financial institutions to voluntarily draft new procedures to ensure proper control of sensitive information.

The move came after The Courant found documents in garbage and recycling bins outside bank branches in Glastonbury and Wethersfield. All of the banks involved said they already had policies on the destruction of such documents, but they had apparently been violated by employees or cleaning staff.

More recently, bank regulators -- including the Federal Reserve and the Federal Deposit Insurance Corp. -- joined last fall with law enforcement agencies, such as the Secret Service, and the Postal Service in urging bankers to remain vigilant in disposing of documents with confidential customer information.

State Rep. Robert A. Landino, D-Westbrook and co-chairman of the legislature's banks committee, said he would research the need for a law on the destruction of such documents.
"It's a legitimate concern,'' Landino said.

Both Fleet and Aetna said their policies require that documents with confidential information be shredded, but those measures broke down because of human error. In Fleet's case, the deposit slips got mixed with other trash at its Hartford processing center.

Aetna said a sorting error -- paper being sorted by type rather than content -- led to the highway fiasco. To avoid a recurrence, all disposed of paper will be shredded, said Fred Laberge, an Aetna spokesman.

Jim Schepker, a Fleet spokesman in Hartford, said the bank handles millions of pieces of paper with confidential customer information each year, so the 245 slips represent a minuscule percentage. "We work very hard and take a lot of steps to make sure these things don't happen,'' Schepker said. "Occasionally, human error will intervene.''

Don't Let This Happen To You!

Your important documents scattered all over the highway and you are responsible!!!