Provided by ODCBS
(Salem) – The Oregon Department of Consumer and Business Services has fined Samaritan Health Services, Inc., for violating Oregon law by discarding business records with patient names and Social Security numbers. Samaritan operates a nonprofit network of hospitals, physician clinics, health plans, and senior care facilities in Albany, Corvallis, Lebanon, Lincoln City, Newport, and Sweet Home.
In July, a patient at the Samaritan Family Medicine Clinic in Corvallis found approximately 1,222 patient files had been discarded into an unlocked recycling container. Twenty of the discarded files contained patient names and unredacted Social Security numbers. Oregon law prohibits the public posting or displaying of consumer names and Social Security numbers.
As part of the final order, the agency assessed Samaritan a civil penalty of $5,000, but reduced penalty to $1,000 as long as Samaritan complies with the Oregon law for the next five years. “A Social Security number can be a very useful tool for an identity thief,” said David Tatman, administrator of the agency’s Division of Finance and Corporate Securities (DFCS), which enforces the Oregon Consumer Identity Theft Protection Act. “Businesses must be aware of the consequences of failing to safeguard their confidential records, and that includes the secure destruction of those records.”