A Georgia nursing home company has been banned from doing business in Kansas for 10 years and fined $100,000 for failing to protect patient and employee records after the closure of Humboldt’s Pinecrest Nursing Home, Kansas Attorney General Derek Schmidt announced Friday.
Allen County District Court Judge Daniel D. Creitz handed down the judgment last week against AltaCare Corporation, of Alpharetta, Ga.
The company also was ordered to properly destroy all Pinecrest Nursing Home records at the company’s expense by shredding, erasing, or otherwise modifying the personal information in the records.
The judgment resolves a lawsuit filed by Schmidt in May 2017 alleging AltaCare, as the manager of Pinecrest Nursing Home, violated Kansas data protection laws “by failing to implement and maintain reasonable procedures and practices to protect personal information and by failing to take reasonable steps to destroy or arrange for the secure destruction of records containing personal information when the records no longer are to be used.”
Investigators with the Attorney General’s Consumer Protection Division learned Pinecrest Nursing Home was unsecured and was broken into and vandalized multiple times after the facility closed in 2011.
Records containing personal information had been left in plain sight, according to the press release. Although Humboldt city officials notified AltaCare that the records were not secure, the company failed to take action to protect those records and the personal information they contained.
The attorney general’s office secured the records to prevent further potential unauthorized disclosure of personal information.
Personal records may include information such as a Social Security, driver’s license, financial account or credit or debit card numbers that can be misused to commit identity theft or otherwise harm the person whose information is compromised. It also includes any information, such as medical records, for which a security obligation is imposed by federal or state statute.
Under Kansas law, businesses that collect the personal information of others have a duty to safeguard it.
In addition, AltaCare agreed to pay a $100,000 fine and to reimburse the attorney general’s office for the cost of the investigation. An additional fine of $125,000 is suspended on condition the company remains in compliance with the terms of the judgment.
The consent judgment and assurance of voluntary compliance entered this week resolve the state’s claims against all remaining defendants in the case.
The attorney general’s office previously obtained a default judgment in the case in January 2018 against Florida Senior Housing Council, Inc., as the owner of the Pinecrest Nursing Home property. That company was ordered to pay $750,000 in civil penalties and nearly $20,000 in investigative fees and expenses and is permanently enjoined from violating Kansas consumer protection laws.
