When Barbara Jarvis-Neavins rented a house in Aurora four years ago, she says she knew almost immediately the owners had left a few items in the basement.
These were not the usual 20-year-old Christmas decorations, mismatched dishes, or defunct preschool toys of now-grown children. They were the confidential medical records of potentially hundreds of patients – stored there by a Naperville psychiatrist.
And, Jarvis-Neavins said, from almost the day she moved in, the files kept pouring in.
“I see a guy pulling up to the house, and he’s bringing more files in,” she said. “Then the next day …. he’s bringing more files!”
The records – now in the thousands – are in the familiar color-tabbed manila folders you might see in your own doctor’s office. Jarvis-Neavins showed NBC5 Investigates the contents of some of the files – all with the kind of information you probably wouldn’t want shared by your doctor.
“It has their name, their address, their birthdate, their social security number, what’s wrong with them, what they’re being treated for, and what medication,” Jarvis-Neavins said, motioning to rows and rows of shelves and cabinets in the basement, all jam-packed with files. “I could take these files and create identities and get credit cards and do all kinds of stuff, and I could be on an island somewhere. And that’s what I told the FBI.”
Jarvis-Neavins said the FBI cited a jurisdictional issue and sent her to the U.S. Department of Health and Human Services, the agency tasked with enforcement of the Health Insurance Portability and Accountability Act (HIPAA). That law draws careful boundaries over how medical records are to be stored and protected. Jarvis-Neavins said she submitted a complaint form, but never heard back. She also said she contacted the police in both Aurora and North Aurora, but neither followed through.
She also said she contacted the Illinois Department of Financial and Professional Regulation, the state agency responsible for the enforcement of rules involving doctors. She said she even sent photos of the files to one high-ranking official at IDFPR. She said the official expressed concern, but the department has yet to follow up with her.
A spokesman from IDFPR would not confirm to NBC5 Investigates whether they were conducting an investigation of the medical files, saying only that “investigations take time.”
Beyond her efforts to report the files, Jarvis-Neavins also said that a cavalcade of workers have had access to the basement over the years, with the confidential records in plain view – and easily accessible.
“We had about four people, five people, down here for the furnace,” she said. “The chimney person was here. I got a new hot water heater, that guy came down here with his crew!”
Through his attorney, the psychiatrist, Dr. Riaz Baber, sent a written statement to NBC5 Investigates:
“The home has been leased to Ms. Nevins [sic] for approximately 4 years. The basement area where the medical records have been stored should have remained locked, and the Babers have never granted access to the basement to Ms. Nevins [sic]. [Baber’s wife] Freeda Baber has no knowledge of anyone accessing the basement storage area since she accompanied a workman to clean the furnace in approximately August of 2016. There are two entryways to the basement area. One door is an exterior entrance from the outside and the other door is in an interior entrance from inside the home. Both of these doors are locked, and the Babers have never provided a key to Ms. Nevins [sic].”
Jarvis-Neavins disputes that, saying the doctor’s wife gave her a key and asked her to personally escort various workers downstairs, and that it was understood from the beginning that the basement was part of her rental agreement.
“You’re charging me $1,750, and you’ve got their stuff down in my basement,” she said. “You know their darkest secrets and what they told the doctor—you could do a lot of damage with this.”
Jarvis-Neavins told NBC5 Investigates that she had wanted to report the medical files for years, but did not do so because she knew she would likely be asked to move out. Then, this past February, she said Freeda Baber informed her that she would be selling the house, and that Jarvis-Neavins would need to vacate the premises by April 15. (The attorney for Baber confirms this.) Once she knew she was leaving, she felt she could report the files, Jarvis-Neavins said.
Fewer than 24 hours after NBC 5 Investigates first contacted Baber and his attorney, a mover was seen carting box after box out of the house.
“All of Dr. Baber’s medical records stored at the property are being moved out of the home by a bonded carrier, supervised by Dr. Baber’s Office Manager,” the doctor’s attorney told NBC 5 Investigates in his statement.
But beyond the strict HIPAA laws governing the storage and security of medical records, there is another law, concerning any possible breach of this kind of confidential information, that may now come into play: The Illinois Personal Information Protection Act says that the person responsible for keeping confidential records -- such as a doctor -- must inform every single individual whose information may have been breached -- as soon as possible.
In the case of the medical records stored in the basement in Aurora, that would most likely amount to thousands of individuals who -- by law -- should be notified, in the very near future, that their personal information may have been compromised.