Audit Uncovers Workers Throwing Highly Confidential Records of Erie County Residents in the Trash
Department of Social Services employees placed copies birth certificates, social security cards, tax forms, passports, bank account records, and medical records in open boxes and totes
(Buffalo) – An on-going audit being conducted by the Office of Erie County Comptroller Stefan I. Mychajliw discovered Department of Social Services (DSS) workers were placing copies of highly sensitive and confidential documents of Erie County residents in open boxes and totes in an open area in the basement of the Rath Building which were then placed outside in another area open to the public at the Rath Building loading dock.
This serious security breach that potentially exposed thousands of Erie County residents to identity thieves could have been taking place for years. Copies of the personal documents that were dumped in open boxes and totes without being shredded include:
- Birth certificates
- Social security cards
- Social security numbers on various county forms
- Payroll records
- Medical information
- Inmate records
- Personal bank account numbers
- Tax returns
- Court records
“The administration failed to protect the identities of the people they are supposed to serve by haphazardly dumping their most sensitive records in the trash. The highly confidential documents were not shredded. This disturbing security breach is an identity thief’s dream. As far as we know this has been taking place long before I took office, yet nothing was done to protect the identities of Erie County residents until our audit brought this to light. At no point in the disposal process were very sensitive records protected from the perils of identity theft,” said Comptroller Mychajliw.
The personal documents were readily accessible to anyone who entered the open area of the Rath Building basement, anyone who walked by the loading dock that is open to the public, anyone near or in the recycling truck, and to persons at the recycling facility.
Not only did workers expose those who applied for Temporary Assistance to potential identity theft, but also their children whose confidential information was included in the documents that were thrown unsecured in the trash. The social security numbers of children were prevalent in the dumped documents.
The Office of Erie County Comptroller Stefan I. Mychajliw has been conducting an on-going performance audit of the eligibility and recertification process within the Temporary Assistance unit within the Department of Social Services (DSS). One component of the audit concerned internal controls: were any safeguards in place to ensure highly confidential records of Erie County residents were properly discarded in order to protect them from identity theft.
When auditors requested the ability to review case files and documents related to eligibility and recertification for Temporary Assistance the Department of Social Services denied access to the Office of Erie County Comptroller on the grounds that disclosure would violate privacy regulations and laws. Confidential records would only be provided to auditors if they were heavily redacted.
“What is very troubling is that the records workers were carelessly discarding in the garbage in an unsecured manner are the same documents the Department of Social Services claims are so sensitive in nature that our auditors cannot look at them. None of the records found in the trash were redacted,” added Comptroller Mychajliw.
Placement of confidential records of Erie County residents in areas where they are available to someone other than the data subject is considered disclosure of personal and confidential information, which is prohibited by both federal and state regulations.
The administration has been and continues to be responsible for notifying the State of New York and the Federal government that Department of Social Services workers inappropriately disclosed confidential information by simply throwing highly confidential, personal documentation in the trash. Based on initial audit findings it is reasonable to believe this has been taking place for many years.
The subsequent review of the process conducted by auditors from the Office of Erie County Comptroller revealed that at no point during the disposal process were the open boxes and recycle bins secured prior to being placed outside of the Rath Building and placed in recycle trucks. Documents containing confidential information were inappropriately disposed of in violation of numerous regulatory requirements.
As far as the Office of Erie County Comptroller is aware, the administration never contacted individuals who applied for services provided by the Erie County Department of Social Services to notify them exactly how they were irresponsibly disposing of their most sensitive documents, to inform them that their lack of controls put them at risk for being the victims of identity theft.
The Office of Erie County Comptroller notified the administration that, if it has not already done so, they must immediately report this disclosure of confidential to both the Federal and State authorities. They are also responsible to inform Erie County taxpayers that their confidential information has been inappropriately disclosed. There are also remedies available to persons whose confidential information was tossed in the trash.
“Thankfully our audit uncovered this serious security flaw that allowed anyone to dig through open boxes and totes to find private records of Erie County residents. Our audit of the Department of Social Services continues,” said Comptroller Mychajliw.