The U.S. Women’s World Cup Soccer champions toured NYC celebrating their historic win, and were treated to a shower of confetti, some of which appeared to be made from medical prescription records.
One local resident noticed the confetti contained writing and upon closer inspection, realized it was Protected Health Information. The confetti was photographed and uploaded to twitter, with the story being picked up by 12WMAZ.
According to the finder, the data included the patient’s name, treating physician and the address of the location where the prescription was provided; information covered by the Health Insurance Portability and Accountability Act. HIPAA requires all holders of PHI to follow strict rules governing the disposal of PHI. All data must be destroyed and rendered unreadable and undecipherable before disposal.
Each year confetti is purchased for the Thanksgiving Day parade, with the official contract given to Atlas Packaging Company this year. An order was placed for confetti made from strip-cut, blank news roll. Two tons of confetti was ordered, delivered and handed out to local residents. Someone, somewhere potentially violated HIPAA Rules, although who that was may remain a mystery.
According to a recent report on 12WMAZ, the Downtown Alliance – which was managing the parade – purchased two tons of confetti for the 2012 Thanksgiving parade, yet collected 34 tons during the cleanup. A considerable amount of rogue confetti is therefore getting into the county supply.
The official line appears to be that local residents and businesses have been making their own, and have not been too careful about where the paper was sourced.
This is not the first time PHI has fallen from the sky in NYC. Social Security numbers medical records were discovered on ticker tape dropped in NYC during the 2012 Super Bowl, and ticker tape was also found that had been made from Police Department records.