Texas authorities post private information online

05.03.2007

Abbot's ruling requires Texas counties to now redact Social Security numbers from public records before making them publicly available -- a monumental task, Gray said. It means having to go through millions of pages to first identify records containing the numbers, making copies of the pages and then blocking out the numbers on each copy. "You are talking about extra paper, extra storage and extra manpower" to do it, she said.

Until some sort of a compromise is reached, Abbot's opinion could seriously hinder public access to court records, both Gray and Wilson said. Others, however, dismissed those concerns. They said that such redactions have been already made elsewhere and that the technology for blocking sensitive information is available. They pointed to states such as Florida, where county governments are already redacting public records as mandated by a state law. Florida's Orange County in February 2006 completed an 18-month project in which it reviewed more than 30 million pages in more than 12 million public records for items such as Social Security numbers, bank account information and credit card numbers. In the end, 777,635 pages -- 2.6 percent of the total reviewed -- were found to have that needed to be redacted.

"Right now, what you have is a lot of these counties [in Texas] running down to the state legislature and trying to scare them," said Peter MacKoul, president of HIPAA Solutions LC, a Sugar Land, Texas-based consultancy. "They want legislators to write a law running against the [attorney general's] opinion. What they are saying is that it is too difficult to comply with the AG's ruling."

According to MacKoul, at least some of the pressure on the legislators is coming from businesses that have a vested interest in keeping public records online. "Fort Bend sold 20 million un-redacted documents to a Florida list broker for about US$2,500," MacKoul said. The same documents would have cost $1 apiece at the courthouse. "There are some business interests who don't want privacy rules," McKoul said.

MacKoul's company was hired by Fort Bend County in 2005 to perform a Health Insurance Portability and Accountability Act audit of its Web site and discovered numerous violations of the law. In some cases, records containing detailed health information were easily accessible from the county's public Web site, he said.