What is your responsibility regarding identity theft?

Mini- Storage Messenger - What is your responsibility regarding identity theft?

QUESTION: This month’s question: “We auctioned off a unit that is full of files containing documents containing possible patient information. Are we responsible for possible identity theft? We have no ideas what these files contain but it is some sort of medical/diabetic business. We tried many times to get in contact with the customer by phone, certified mail/return receipt requested, newspaper ad, etc. about the auction date. Has our responsibility ended now that we have done the auction?”

Answer: This is an interesting question and one we receive all of the time. Part of the answer depends on the state in which you are located; the rest of the answer is applicable in any state.

The first thing you have to look at is whether your state self storage statute requires a sale or does it permit disposition or disposal by another method. For example, in Florida (where the person who asked the question is located), the state statute provides that there will be either a sale or “other disposition” and that the advertisement states that the “property will be sold or otherwise disposed of” at a specified time and place. While I have never read the legislative intent of the Florida Statute, we have researched the intent behind the term “other disposition or disposal” in other states such as Indiana, the intent behind this language seems to be a recognition that there is some property that cannot/should not be sold. The Florida Statute gives you the opportunity to avoid the sale, because (short of identity thieves), who is going to want boxes of medical records? The answer is certainly no one should or would, and in states like Florida where you have the right to otherwise dispose of the property, it is my opinion that you should send a notice of intent to sell or dispose, then run the notice of intent to sell, but call it a notice of intent to dispose, with the ad indicating it is your intent to dispose on the date that would normally be the sale date. Then dispose of it by shredding it. Please do not take a shortcut and dispose of property just to avoid a sale, unless the property should not be sold. Please consult your attorney for more information.

There is actually a guy who has been found in New York who makes some form of a career out of going to self-storage facility sales and buying units that appear to have information or records in them. He then scours through these records and boxes and finds social security numbers, and etc., and then is apparently contacting the former occupants for money. Those people who do not want their information sold over the internet will pay this person for the goods that he just bought out of the unit. While this is probably best characterized as blackmail, so far, to the best of my knowledge this fellow has not been stopped.

So, where you have the option to dispose, you should dispose instead of selling these types of items. You should dispose by shredding. I do realize that costs you extra money, but it leads neatly into my second part of my answer.

The second part of my answer is that the court of public opinion requires that you properly dispose of these records by shredding or other destruction. There is not enough money in the world to undo the kind of bad publicity that you would get if a local TV channel or newspaper’s investigative reporter bought those medical records at your sale and then ran an expose about how easy it is to get peoples social security numbers and other information from the records that they bought at a self-storage sale. I venture to say a story like that would probably cause, in your case the Florida Legislature, to change the rule on sale or disposal. Thus, as a responsible member of the self-storage community, you are responsible to the other owners in your state, to shred the documents.

In my home state of Ohio we have reached some level of agreements with the Academy of Medicine, Pharmacology, and the Accountants to be willing to hold and try to sort through and hand out medical records, pharmaceutical records, or accounting records to those who may want their records back knowing that they may be shredded or otherwise disposed of You may have this agreement in your town. Operator’s try to make sure that they are doing the best they can to get the records into the right hands without having “nosey” people getting a hold of them. After that, our clients destroy everything that isn’t claimed.

We recently had a television station in my home town go “dumpster diving” at a local Walgreen’s. They pulled all of the misprinted labels and forms out of the dumpster which were not shredded and, under the supervision of the FDA they were able to order refills to all sorts of prescription drugs. The point was, your pharmacy did not take good care of your records and with a refill number you can order and get a refill on that person’s insurance before they know to come claim the refill. Since the label told the reporter the name, address, and prescription number of the person, the job was easy. Guess where the TV station broadcast the story in front of? You are correct, the Walgreens sign.

In addition to your responsibility to otherwise dispose of these records to protect the citizens of your state and your industry, you would probably find it tough to recover from a newspaper or television station expose indicating that they were dumpster diving at your facility or bought the records at your facility and were able to release that information for sale on the internet and make a profit. Whatever you save by not shredding, you have more than lost in damage to your business reputation.
Thus, I would not have auctioned off the records. I would have shredded them and avoided any potential exposure.

You can send your questions, comments, or suggestions for future topics to Jeffrey Greenberger at info@selfstoragelegal.com or mail them to Jeffrey Greenberger c/o Katz Greenberger & Norton LLP, 105 E. Fourth Street, Suite 400, Cincinnati, Ohio 45202 or you can reach Mr. Greenberger at (513) 721-5151, or visit his website at www.selfstoragelegal.com.