DENVER -- At the sprawling Veterans Affairs Medical Campus in Cheyenne, Wyo. thousands of medical records are sent out yearly.
Those records contain social security numbers, dates of birth, names and personal information usually kept between a doctor and patient. However, a FOX31 Denver investigation found sometimes those records are sent to the wrong person.
“My initial reaction was there must have been some kind of mistake,” said John, a man whose name we’ve changed to protect his identity.
He ordered his medical records from the Cheyenne office earlier this year and when he got the CD with his medical history, it included the medical records of three other men. There were more than 6,000 pages of detailed information on those men who lived in different parts of the country.
“I made the mistake of clicking on these records and wondering, when was I diagnosed with colon cancer?” John said.
One of those men, Terry Tegt, lives 750 miles away from Denver. He had no idea his identity was compromised until we called him about our investigation.
Tegt said he wasn't surprised to hear about the mix-up because, "It happened before."
Two years ago Tegt ordered his medical records from the VA facility in Cheyenne and he got someone else’s medical history.
“The VA says it can't happen. They always say it can't happen, but it does happen,” said Tegt.
We found it does happen, and often.
In the last three months of 2013, nearly 2,300 record breaches happened across the entire VA system. The risk of identity theft was so bad the VA was forced to offer those veterans credit protection.
Dan Warvi, spokesman for the VA system in Colorado and Wyoming, admitted a mistake was made when a worker copied the wrong information onto John’s CD.
“Since this file was so big, it required it to be burned on more than one disc,” Warvi said.
He said the clerk inadvertently included the extra files on a second disc, not realizing until after it was mailed to John.
“We take these violations of veterans’ safety very seriously,” he said, adding that new safeguards are in place to make sure it doesn’t happen again. Here are the safeguards, according to the VA:
- Each Release of Information (ROI) action will be reviewed by the staff member preparing the release, a second staff member and a supervisor to ensure that the information is complete, is the correct patient's information, that no other patient's information is included and that the information is being addressed to the correct address. Each staff member and supervisor will initial and date each release on a checklist to provide documentation of compliance.
- Prepared materials will be relocated to the supervisor’s office to ensure that all verification steps have been completed prior to pick up by the mail room for mail out to recipient.
- The function of preparing information for release will be relocated to a more secluded desk approximately 10 feet distance from the check in window in order to minimize the level of distractions,
- We’ve also taken steps with our Information Technology section to ensure that only one file can be uploaded to one disc.
Congressman Mike Coffman, who is a veteran himself and the head of the House Subcommittee on Veterans Affairs, believes big changes are needed.
“It seems to be a culture within VA that has been allowed to develop, where people aren’t accountable," Coffman said.
He said if our whistle-blower John hadn’t come forward, the VA would have swept this under the rug.
“Their first response is to deny there’s a problem. Second response is trying to cover it up. Third response is defend those responsible,” said Coffman.
He added that no one is ever disciplined or fired for mistakes at the VA.
Warvi wouldn’t disclose if the employee responsible for sending medical records to the wrong person was disciplined or fired, but he said errors will probably happen again as long as humans are involved.
Tegt said his privacy is already violated and wants to person responsible to be fired. He believes it will happen again.
Any veteran who has questions about their medical records can contact their local VA office, but no requests can be made over the phone. You can also check out more information at the following links:
Denver VA: http://www.denver.va.gov/patients/roi.asp
Cheyenne VA: http://www.denver.va.gov/patients/roi.asp