Pain clinic sends 6 Social Security numbers to patient

GWINNETT COUNTY, Ga. — A Gwinnett County pain clinic is promising changes, and promising to make it right for patients whose social security numbers got mailed to a stranger by mistake.
 
"I was shocked," Vickie Cruel said of the documents she received. "I could completely wreck someone's credit history with this."
           
When Cruel asked Buford Pain and Rehab for her Medicare billing records, she received print outs of her information along with those six other patients.
 
The names were blacked out but the social security numbers were not.
           
"For me to get this much information requesting a copy of my bill; I was floored," she told consumer investigator Jim Strickland.        
           
Using a common Internet search service, Channel 2 Action News used the Social Security numbers and identified the patients.
           
"That's my social security number. That's my personal information. That's my privacy, and if it's out there for anyone to take I have serious problems with that," said patient Elee Oliver after Strickland informed him of the breach.
           
"Any patients whose data has been compromised will be contacted.  We will do everything in our power to make them whole and help satisfy any questions that they may have," said clinic director Dr. Frank Free. 
           
Free explained an office staff member didn't realize Medicare still uses social security numbers as patient account numbers, so they were not redacted.
           
He also showed Strickland how Medicare lumps the information of several patients on a single billing sheet. A patient requesting his records gets print outs of several clients without redaction at the source.
           
Free emailed Strickland saying that each patient involved had been called and will be notified of the mistake by certified mail.
           
Strickland's calls and emails to Health and Human Services in Washington were not returned.

WSBTV