November 27, 2014

Elyria
Flurries
31°F
test

Resident finds computer with medical information for 15,000 patients

Carl Forrider found a computer he says contains medical information for 15,000 patients. It was left behind when a doctor moved offices. BRUCE BISHOP/CHRONICLE

Carl Forrider found a computer he says contains medical information for 15,000 patients. It was left behind when a doctor moved offices. BRUCE BISHOP/CHRONICLE

ELYRIA — Would you want a complete stranger to know when you went to the doctor, what pain or ailment you wanted him to fix and what he decided should be your course of action?

How about the medical test you took toward finding a diagnosis and what illness or diseases you may now have?

What about all of that information along with your name, home address, Social Security number and your medical insurance information and the same information for your children, too?

Jennifer Goldauskas of Wakeman said allowing that all information to be released is scary given the real threat of identity theft nowadays.

Luckily, she was the person to end up with a discarded computer that contained her medical information and that of thousands of others.

“I couldn’t believe it. So much information was just right there at my fingertips,” Goldauskas said. “All I could think is this computer is safe with me because I won’t do anything with someone’s personal information, but what if it had not been me who got this computer?”

A family doctor who spent 15 years at an office on Cleveland Street recently moved to a new location, but left behind a computer containing the personal information of thousands of patients in the process.

Social Security numbers, names, addresses, copies of medical insurance cards and detailed information from office visits were all saved and easily accessible in a computer tower once owned by Dr. Chuka Onyeneke. It, along with several other items Onyeneke left at 160 Cleveland St., was headed for the trash, but the computer instead ended up at Golauskas’ home.

With the recent data breach that exposed the information of perhaps as many as 70 million Target customers and the retail giant working to determine how many customers had their information compromised, identity theft is high on the minds of many.

However, Onyeneke downplayed the abandoned computer.

The icon on a computer that Carl Forrider found offers access to medical information for 15,000 patients.

The icon on a computer that Carl Forrider found offers access to medical information for 15,000 patients.

“My patients are safe with me, and the information they give me is safe with me,” he said.

Goldauskas, 35, said she got the computer after her fiance, Carl Forrider, was asked to help clean out the office for a new tenant.

Forrider said he was told by the property owner everything left in the space was headed for the garbage, but he could salvage anything he wanted. The older-model computer with a monitor caught his attention. His teenage son needed one to play computer games, so it went home with him.

“I turned it on, and just being funny said, ‘Let’s see if anything is on this thing,’ ” Forrider said. “I was thinking the hard drive was wiped clean.”

The shocking realization came when he easily was able to find images of scanned insurance cards and medical documents with Onyeneke’s name listed as the physician of record. Files with date stamps between January 1996 and December 2012 were on the computer and a full-screen slideshow allowed Forrider and Goldauskas to quickly flip through hundreds of images.

Onyeneke said Thursday he was almost certain he took all patient information and computers with him when he went to the new location. His office is now on North Abbe Road.

“If one was left behind, it was done by accident and I would work to get the computer back,” he said. “No one cares more than I do about my patient’s information.”

Onyeneke was adamant the computer and its programs were password protected. But an icon on the desktop — The Chronicle-Telegram verified the ease of accessing the data Friday when Forrider and Goldauskas brought the computer to The Chronicle office — gave the user a shortcut list of employee user names and passwords to further access data on the computer.

Several of the files were diagnostic reports and test results for patients who had tests conducted at EMH Healthcare facilities. The medical center is now known as University Hospitals Elyria Medical Center after a merger that went into effect earlier this year.

A Care Source identification card with a patients name, addres and social security number is displayed on a monitor.

A Care Source identification card with a patients name, addres and social security number is displayed on a monitor.

Hospital spokeswoman Kristen Davis-Kutina said Onyeneke was never employed as a doctor at EMH and his privileges to practice at EMH facilities ended in July 2011 when Amherst Hospital stopped accepting patients.

Davis-Kutina said the hospital staff learned about the abandoned computer when contacted by a reporter and are investigating the matter on their end.

“This is the first time we have heard of this,” she said.

On Friday afternoon, Goldauskas’ outrage over what she called a disregard for hundreds of identities turned to utter disgust when she happened upon a familiar name on the computer — her own.

“I went to see him a lot like seven or eight years ago, but I didn’t think to look for my name,” she said. “He is just this nice doctor known for getting you in and out with the meds you need. But look — my Social Security number, my name — everything — is just right there.”

As a Chronicle reporter read Goldauskas’ detailed files, including specific reasons why she went to see Onyeneke on certain dates, she quickly turned her head.

“Stop. It’s like you’re going through my purse,” she said.

When asked why she didn’t just track Onyneke down and return the computer, Goldauskas said doing so would not help everyone whose files were on the computer.

“Then no one would know. People wouldn’t know their stuff was out there and how careless people can be,” she said. “If I knew this was the only computer, I would have gotten rid of it. But the what if is what is scary.”

Contact Lisa Roberson at 329-7121 or lroberson@chroniclet.com. Follow her on Twitter @LisaRobersonCT.


  • David Christy

    Three words: Whole Disk Encryption.

  • formerlorainresident

    Just wait until the Federal Government has all your medical records, which include your identity information.

    A “Hacker’s Paradise.”

    • Phil Blank

      Already happened, few years ago: People at the Veteran’s Admin have already lost computers and laptops with veterans info on them.

  • John Davidson

    This is a major HIPPA violation. The doctor must report it and he is subject to heavy fines. Also found it interesting that “He is just this nice doctor known for getting you in and out with the meds you need.” There was a doctor in Eaton township like that once.

    • banshee70

      Yeah, I enjoyed that comment, too…

  • Phil Blank

    I ALWAYS take the HD out and destroy it physically!
    Pull the memory and any other reusable parts.

    • HankKwah

      You’d think other people would do that, too.

      I don’t think many people are that familiar with how a computer works or how it’s constructed. Many think that deleting something means it’s gone forever. Not so.

  • GreatRedeemer
  • HankKwah

    “My patients are safe with me, and the information they give me is safe with me,” he said.

    ——–

    Obviously, NOT.

  • SpaceTech

    Really?
    They couldn’t have just contacted the doctor and ask if they realized that a computer was left behind that had info on it?
    Instead, they feel the need to run to the local newspaper to TRY and make some sort of name for themselves?
    People are pathetic, I hope their next indescretion winds up on front page because someone else thought it was newsworthy.

    • banshee70

      I was thinking the same thing, especially after she admitted to going to “doctor who gets you in and out with the meds [drugs] you need.” And after seeing this, why did they continue to look instead of immediately turning it off and calling the said doctor?

    • open your eyes

      this computer was not left on accident in fact there was a couple more left in this office for months before clean up happened, The issue was not about the one computer that was brought to attention but all the other computers and information that could be in some elses hands.

  • Zen Grouch

    Doesn’t the number 15,000 seem WAY too high?

    The article states that the doctor was in practice for 15 years at the one location.

    To tally up 15,000 patients in that time, he would have to take on 19.23 new patients per week for that entire time.

    That would be one Fantastic practice!

    Then there’s the matter of an old discarded computer having a database program sophisticated enough to process and store the various amounts of information required to keep track of 15,000 individuals!

    The numbers don’t ring true.

    • banshee70

      I love facts.

    • hate pc!!

      it was a practice and an urgent care, also he had or still has a location in avon. but I agree that does sound like a lot

    • Conservator440

      Practice management software handles a great number of patients, limited mostly by the size of the hard drive. Backups of the data take a surprisingly small amount of storage space.

      • Zen Grouch

        What kind of practice management software can handle 15,000 patients and run on a single, stand alone computer?

        Anyway, I could be wrong, haven’t worked with databases in a while, and things change fast.

        OK, for argument’s let’s say the computer does have the medical records of 15,000 patients…

        That would be about 5% of the population of Lorain County and no matter how you shake it, that’s too huge a practice to be putting all of it’s electronic eggs into one basket.

        It’s certainly too much information to leave behind intentionally.

        So when the doctor stated that he wanted the computer back, he had good reason to make his claim to it.

        Why then wasn’t the thing returned to it’s rightful owner rather than being paraded around until the lucky finder can figure out how to make a few bucks off of the situation?

    • open your eyes

      everyone has something to say about everything, but it was varified of how many peoples information was (in files) was on that system.

      • Zen Grouch

        I didn’t see, in the article, how that number was verified.

        You claim to know what’s going on. So, how was that magic number of 15,000 patients arrived at?

        I only saw a definitive statement in the headline of the story that claimed the medical information for 15,000 patients was found, strongly implying that it had been lost.

        Amazing that such a round number of patients was on the computer. Not more or less than, but medical records for exactly “15,000 patients” was found.

        I suppose the reporter would have verified that number, otherwise the good doctor who was mentioned several times in the story would have good reason to sue everyone involved for libel.

  • Zen Grouch
  • Zen Grouch

    **“If one was left behind, it was done by accident and I would work to get
    the computer back,” he said. “No one cares more than I do about my
    patient’s information.”**

    Sorry Doc… looks like someone has other plans for your misplaced computer!

    This could turn so nasty in civil court at least 3 different kinds of ways…

    …and I’m not talking about the doc being on the dirty side of that stick.

  • beety

    This Dr. should have definitely been more careful with patient information. The people who found it should have also stopped looking once they found out what was accessible. Both parties are wrong.

  • Conservator440

    This is a serious HIPAA violation, and at 25 thousand a violation, this could have been a huge fine. Health care providers are responsible for all protected healthcare information, at all times, in all media and can be held liable for its safety, even if it is stolen from their offices. The computer hard drive should have been wiped clean or the drive removed and physically destroyed, never left in a usable state.

  • Jamie Smith

    Wow these comments are very interesting. Sorry but Nobody is going to get their 15 minutes of fame finding this computer. Two wrongs never make a right.

  • thisworldsucks

    That is messed up, my kids and i went to him few yrs back, makes me wonder if my information is still on that machine, Great job As%Hole…. is my information going to be safe now?

  • Brandy Lynn

    So why is everyone looking at all the patients info wtf. Just give the computer back, no need to go through it!

  • open your eyes

    actually the hard drive was destroyed and was handed back over to the doctor the next afternoon. People are just not seeing this whole picture, this story was put out because people should of been aware that personal information about patients was out there. Its not the computer that was brought to peoples attention,its the other computers and personal documents that where thrown in dumpsters or other people could have, that was the issue. People have the right to know.

    • Zen Grouch

      **actually the hard drive was destroyed and was handed back over to the doctor the next afternoon.**

      The doctor stated that this was his property and he wanted it back, however the person who decided to hang on to it, then decided to destroy that property?!

      And how would the doctor know that the damaged drive he was given was indeed HIS property.

      AND since you seem to have all the answers, did Mr. Forrider receive permission from the doctor to destroy his valuable records?

      If I were that doctor, I would temporarily shut down my damaged practice, find out exactly who was responsible for leaving that computer behind (employee or contractor), regroup and find the nastiest attorney in all of northern Ohio and either regain my reputation or make enough cash to retire and get the heck out of Lorain County.

      • Guest

        for one the police verified the hd belonging to that computer,and its not the only computer that was left for over 3 months, your failing to see that as well. how about all the paper work that was just tossed?? No one needed permission for any of the stuff that was left, it was gave by the owner of the building. and I should know all the answers due to being involved with this issue.

        • Zen Grouch

          Thanks for your input.

          BTW… What did the police do to determine ownership of the hard drive before allowing it to be destroyed?

          Seems like the doc said it belonged to him.