After collecting nearly 600 kilograms of papers from recycling bins at five Toronto hospitals, researchers at St. Michael’s Hospital found 2,687 documents containing personal health or other information that should instead have been shredded.

Most of the documents were from physicians’ offices, and financial information was the most common type of personal information found, according to a study published online in the journal JAMA.

Lead author Dr. Nancy Baxter, chief of the General Surgery Department at St. Michael’s Hospital, says that because human error is a common cause of privacy breaches within institutions, hospitals should find ways to reduce the number of paper documents created and be vigilant about shredding them.

“Patients have a right to expected safekeeping of personal information,” Baxter says. “In many jurisdictions … protection of personal health information is codified in legislation.”

Baxter notes that with patient information increasingly being maintained in electronic health records, paper records are frequently discarded, creating greater risk of paper-based privacy breaches.

Her team collected recycling material from five hospitals, all of which had policies around the protection of personal health information, recycling bins, garbage bins, and secure shredding receptacles. At each site they collected all recycling material at least three times a week over four weeks from inpatient wards, outpatient clinics, emergency departments, physician offices, and intensive care units.

In total, they collected 591.6 kilogram of recycling, including 2,687 documents with personally identifiable information. Of these items 802 were low sensitivity, 843 medium and 1,042 high sensitivity. Personally identifiable information and protected health information was found in recycling at all hospitals. Most items (1,449 items) were recovered at physician offices.

Baxter says her interest in the topic dates to when she worked at a hospital in the U.S. and tried to block a housekeeping employee who was transporting a huge recycling bin overflowing with patient documents. Someone in a clinical unit had used a recycling bin to dispose of documents instead of the bin for shredding.

“I told the housekeeping staff he couldn’t take the bin to recycling as it contained personal health information and needed to be shredded,” she says. “He told me he had to. I physically blocked him from moving and had to call hospital administration.”