SAFETY HARBOR — Elsie Huebner has the private health information of people she has never met.
• The 31-year-old Tampa woman who went to a psychiatrist seven times between July 27 and Sept. 22, 2009;
• The 46-year-old Tampa man who took atenolol, a drug used to treat chest pains, high blood pressure and heart attacks;
• And the 44-year-old man who was prescribed oxycodone or OxyContin six times over three months.
"Somebody who was dishonest about this could take people's names and birth dates and what drugs they were taking and do some damage to the people," Huebner said. "If I were this gentleman who had six prescriptions of oxycodone, I wouldn't want anybody to know it. Would you?"
Huebner, 73, didn't go fishing for information; it came to her.
Since last summer, Aetna and UnitedHealth Group have mailed personal medical records of its customers to her Safety Harbor home, which they've mistaken for the medical offices of at least 10 doctors.
Huebner has tried everything. She has written "return to sender" and "wrong address" on the letters and stuffed them back in her mailbox. She has tracked down the doctors' phone numbers and called them. She has enlisted the help of the Area Agency on Aging of Pasco-Pinellas. And she has complained to the Centers for Medicare and Medicaid Services, a subsidiary of the U.S. Department of Health and Human Services. That agency enforces the Health Insurance Portability and Accountability Act of 1996 (HIPPA), the federal law that prohibits health care providers from releasing patients' information to others without their permission.
Despite her efforts, all she has received in response are form letters; the medical histories of strangers continue to land in her mailbox.
"I don't appreciate writing a federal government about this and receiving a form letter without a followup phone call, without them taking it seriously," she said. "Now that irritates me as much as receiving these envelopes from insurance companies. I worked for the government. I'm retired from the government.
"We're talking about people's personal information here and I've yet to receive a phone call."
HHS spokesman Bill Hall did not address any complaints from Huebner in an e-mail to the St. Petersburg Times. Instead, he said "responsibility for determining a correct address — and for any impermissible disclosures caused by using an incorrect address — stays with the entity making the disclosure of protected health information."
The agency's website says a person who knowingly obtains or discloses individually identifiable health information in violation of the law faces a fine of $50,000 and up to one-year imprisonment. The criminal penalties increase to $100,000 and up to five years' imprisonment if the wrongful conduct involves false pretenses, and to $250,000 and up to 10 years imprisonment if the wrongful conduct involves the intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm.
Aetna spokesman Walt Cherniak said this is what happened:
The company performs quality checks on members' prescriptions. It mails that information to physicians across the country "to ensure that medications have been prescribed at the proper dose," he said. "It exists (because) a drug that might be prescribed for a member might be dangerous taken in conjunction with another prescription."
The addresses for the physicians are procured through vendors who manage and assemble databases and then sell that information to various parties, including insurance companies like Aetna.
"There appears to be an error in the database, and we're taking steps to remedy that," Cherniak said early Wednesday evening. "We have already shut off mailings to (Huebner's) address in our system within the hour."
He would not name the vendor.
"Frankly I don't feel comfortable sharing that kind of information until we know more solidly what happened here," Cherniak said. "We are continuing to investigate and take remedial steps.
"We take great pains to protect our members' personal information. We're very alarmed by this information and we're going to take quick and decisive steps to prevent further disclosure of this kind of information."
Prescription Solutions, the UnitedHealth Group company that also sent unsolicited mailings to Huebner, echoed that sentiment. Company spokesman David Himmel did not respond to specific questions about Huebner's case by press time, but said "we really want to get this issue resolved so we'll stay on it."
Huebner was glad to hear that the Aetna mailings she continues to receive will soon cease.
"That's good news," she said. "That's one down."
Times researcher Carolyn Edds contributed to this report. Rodney Thrash can be reached at firstname.lastname@example.org or (727) 445-4167.