fb-pixel$140k penalty for data breach - The Boston Globe Skip to main content

$140k penalty for data breach

Health records mishandled; firm, doctors to pay

The former owners of a medical billing practice that dumped sensitive health ­records at the Georgetown Transfer Station have agreed, along with doctors involved, to pay $140,000 in a settlement with the Massachusetts attorney general’s office.

A Globe photographer ­noticed the pile of paper ­records when he was tossing out his own trash in July 2010.

The pile consisted of ­records for more than 67,000 people, including names, ­addresses, Social­ Security numbers, pathology reports for people tested for various kinds of cancer, and other test ­results.

The photographer collected some of the documents, and the Globe contacted the hospitals that had contracted with the pathologists who had shared information with the billing company.


State and federal laws ­require health records to be disposed of in ways that ­destroy personal information, such as by shredding or incineration.

“Personal health information must be safeguarded as it passes from patients to doctors to medical billers and other third-party contractors,” ­Attorney General Martha Coakley said in a press release.

“We believe this data breach put thousands of patients at risk,” she added, “and it is the obligation of all parties involved to ensure that sensitive information is disposed of properly to prevent this from happening again.”

Joseph and Louise Gagnon, former owners of the billing company, Goldthwait Associates, will pay the civil penalty and contribute to a state data-protection fund, along with Milford Pathology Associates, Milton Pathology Associates, Pioneer Valley Pathology Associates, and Dr. Kevin Dole, the former president of Chestnut Pathology Services.

There was no evidence that the mishandling of the records resulted in identity theft or other improper use of the ­patients’ information.

Chelsea Conaboy can be reached at cconaboy@