WakeMed breached confidentiality of thousands of patients

WakeMed Health and Hospitals will soon notify thousands of patients that their personal and medical information was disclosed in court filings over six years.

A federal bankruptcy court in Raleigh ordered the Raleigh hospital to send out the letters and to offer each patient one year of free credit monitoring. The court last month fined WakeMed $70,000 for disclosing Social Security numbers, birth dates and the full name of at least one minor in claims it had filed in federal bankruptcy courts to collect unpaid medical bills. WakeMed had disclosed the identifying patient information from 2007 to 2015.

There is no evidence that anyone discovered the personal information in bankruptcy court dockets and used it to commit identity theft or some other abuse. However, U.S. Bankruptcy Judge Stephani Humrickhouse wrote in a court ruling that an organization like WakeMed that regularly participates in bankruptcy proceedings should have been a lot more careful.

“You can see the problem: If you put all that information together, essentially that’s all you need to get to the heart of the client’s confidential information,” said Travis Sasser, a Cary lawyer who represents Janis Monroe Clark, one of the patients. “You could do a lot of damage with all those things together.”

The court in August ordered WakeMed to pay Clark $11,140.69 and Carla Lynette Bostick $10,000; their lawyers discovered the problem and brought it to the court’s attention. A third patient, Wayne Edward Branch of Wallace, was not awarded any damages because WakeMed didn’t disclose his personal information. But WakeMed did disclose Branch’s medical record number, hospital admission date, and medical treatments and services, so he filed a separate suit seeking financial damages last week.

The awards raise the specter that WakeMed could face a flurry of lawsuits from the remaining affected patients.

“One would say that the door may be open,” said Joseph Frost, a Raleigh lawyer representing Branch and Bostick. “If their information was disclosed, they have the ability to do what they feel is right.”

I don’t want it to be a marketing product for WakeMed. It’s not to be a vehicle for WakeMed to make themselves look like the good guy.

U.S. Bankruptcy Judge Stephani Humrickhouse

WakeMed says it filed 4,470 claims against patients from December 2007 through December 2015, but the organization did not improperly disclose personal patient information in each instance. Earlier this year, the court blocked access to the documents at WakeMed’s request.

“The privacy and security of our patients’ information has always been and continues to be a top priority,” said WakeMed spokeswoman Kristin Kelly.

When dunning patients in bankruptcy claims, WakeMed typically collects a fraction of the unpaid medical bill.

WakeMed expects to mail the notices in the coming weeks, Kelly said. In a court hearing last week, Humrickhouse warned both sides that the letters should be clear, direct and stripped of self-serving language.

“I don’t want it to be a marketing product for WakeMed,” the judge said. “It’s not to be a vehicle for WakeMed to make themselves look like the good guy.”

The judge also warned the attorneys that the purpose of the notices is not to drum up clients for litigation: “I equally don’t want it to be a marketing product for lawyers who might think this is something they should initiate an adversarial proceeding over.”

According to Humrickhouse’s sanctions order, issued Aug, 31, most of WakeMed’s bankruptcy claims were filed by employee Valeria Soles, who retired Dec. 18 after working more than 33 years with WakeMed’s patient financial services and collection department. In court testimony, Soles said she had no training and no supervision with regard to filing claims, and she testified that no one else in her department knew how to file bankruptcy claims.

In levying a penalty against WakeMed, Humrickhouse concluded that WakeMed did not knowingly violate patient confidentiality.

“But the magnitude of the violation, and the fact that there was no supervision or training, indicates that WakeMed was more than negligent,” Humrickhouse wrote. “The fact that no one was reviewing the rules that might apply is unforgivable.”

John Murawski: 919-829-8932, @johnmurawski