The Department of Mental Health still doesn't know why or how hundreds of patients' confidential medical records were left out in the open at the now closed Lakeshore Mental Institute.
A former employee discovered documents Tuesday while on a walk in the park. She found confidential information such as social security numbers and birthdays dating back to 1995.
Wednesday, a representative from the Department of Mental Health collected the records for further investigation.
It is unclear if anyone stole or used this information for identity theft.
But if someone did, Sword and Shield security consultant, Chris Bevil, said it could have serious consequences.
Bevil said the kind of information found at Lakeshore is sold on the black market for relatively little, about $1 per social security number and up to $50 per medical record.
But, he said, stealing someone's identity can have a major impact on their medical and financial records.
"They can begin to open credit cards, they can open bank accounts. They're able to access a lot of money," Bevil said.
At this point, it's too soon to tell if this is in fact a security breach.
"We don't actually know what happened with the information at Lakeshore. If it was actually breached and someone did take that information. There are several things per the HIPAA Breach Notification that would have to occur," he said.
That breach notification plan includes alerting every patient via phone and letter as well as the Health and Human Services.
He also says the burden of that identity theft falls on the hospital.
With what we know, Bevil says those patients or their caregivers still need to take precautions.
"They are probably the most vulnerable of anyone because they don't know to take these steps. So the caregiver or the person responsible does need to take some sort of action," he said.
The Federal Trade Commission offers step by step guidelines that should be followed if you feel your social security or any information has been stolen.
The Department of Mental Health said all of the documents have been removed and are being investigated.
Now the department is consulting its attorneys about what to do next.
Department of Mental Health spokesperson, Michael Rabkin, said they are still trying to figure out why the documents were there in the first place. 10News was the first to alert them on Tuesday. He said they are not sure how long the documents have been there or if the building was ever used for storage.
Rabkin said when Lakeshore closed, all documents were supposed to be stored in a secure facility or digitized and shredded.