Report: Unauthorized Firefighters Accessed Pa. 911 Records
Source Pittsburgh Post-Gazette
July 17--A report from a private investigator hired by Monroeville claims the municipality's 911 dispatch information was regularly accessed by unauthorized individuals but left open the question of whether any federal privacy laws were violated.
The confidential report, which was obtained by the Pittsburgh Post-Gazette, concludes that for more than two years some volunteer firefighters accessed information from 911 calls that should have been off-limits to them.
John J. Daley, a private investigator who wrote the report, placed ultimate responsibility on police Sgt. Doug Cole, who was demoted from police chief after then-Assistant Chief Steven Pascarella filed a complaint with federal authorities alleging a breach of protected health information.
Mr. Cole declined to comment on the report.
In addition to Mr. Cole's demotion, the controversy has led to federal and internal investigations and a shakeup of Monroeville council.
Attorneys with Dickie, McCamey & Chilcote, the Downtown Pittsburgh law firm the municipality hired to conduct the investigation, last week sent the U.S. Department of Health and Human Services a packet of documents compiled by private and forensic investigators that detail how 911 dispatch information was managed in Monroeville.
Mr. Daley's report was distributed to elected officials July 2. Among its findings:
--Monroeville 911 records -- including names, addresses and medical information -- were accessible to unauthorized people from August 2010 through February 2013.
--There was no protocol in place to remove former or inactive emergency responders from the list of people receiving 911 dispatch data.
--Curious volunteer firefighters were able to access police call information, sometimes after hearing calls on the police radio.
--Firefighters on one occasion reportedly reviewed police 911 information about a rape case.
--Members of the police and fire departments appear to have violated the municipality's employee handbook regarding computer usage.
--Mr. Cole was repeatedly warned about potential problems with access to dispatch data, but said in interviews with investigators that he did not recall such issues being brought to his attention.
"In retrospect," the Daley report concludes, "had the decision makers, who were responsible for setting up and operating Monroeville's 911 center [computer-aided dispatch] system, conformed with Monroeville's Computer System Data Security Policy, and thereby restricted access to those with a 'need to know,' this entire incident would not have happened."
Mr. Daley said that Mr. Cole was "ultimately responsible" for protecting the data from the computer systems in the 911 center, adding that he should have heeded the warnings of Mr. Pascarella and Monroeville Volunteer Fire Co. No. 5 president Kenneth Kuzins, who recommended restrictions on access to dispatch information.
The municipality has been embroiled in controversy since August, when Mr. Pascarella, who is now the police chief, filed a complaint with the Department of Health and Human Services' Office of Civil Rights alleging a breach of the Health Insurance Portability and Accountability Act, or HIPAA. If the department finds "willful neglect" has occurred, Monroeville could be fined as much as $1.5 million.
Mr. Pascarella's complaint was sparked by a text message sent by retired Monroeville police Chief George Polnar, now manager of security and parking at UPMC East, to Linda Moy, the police chief's secretary.
The text contained the address, age and medical condition of a Monroeville resident who lives on Ms. Moy's street and requested an ambulance. Ms. Moy showed the text to Mr. Pascarella, who recognized it as a dispatch report only current emergency responders should have had access to. Mr. Polnar retired as police chief in January 2010 and is also a former volunteer firefighter and paramedic for the municipality. Mr. Daley wrote that Mr. Polnar declined to be interviewed as part of the investigation.
In the Daley report, Mr. Pascarella said he repeatedly told Mr. Cole about unauthorized users having access to the municipality's 911 dispatches, but no action was taken. Mr. Pascarella told Mr. Daley that he filed a federal complaint because his job would be protected by whistleblower laws.
Since then, the municipality has split into two camps -- one supporting Mr. Pascarella and his accusations, and the other rallying behind Mr. Cole. The four council members who lobbied to remove Mr. Cole from the top job in the police department will all be out of local government come January -- two lost primary bids, one opted not to run and another said he's pulling his name off the ballot.
Mr. Kuzins, who is also an employee in Monroeville's public works department, told Mr. Daley that he, too, warned Mr. Cole about unauthorized access to the dispatch center.
Mr. Kuzins told Mr. Daley he was at the Monroeville Volunteer Fire Co. No. 5 in winter 2011 or early spring 2012 when he heard firefighters talking about a rape and "saw that the [dispatch] entry regarding the rape was displayed on the computer terminal in the fire station's kitchen area."
"Mr. Kuzins said he asked one of the young firefighters ... to show him how they were getting access to the police department's [dispatch] entries," Mr. Daley wrote. "The firefighter then demonstrated to Mr. Kuzins how he could use a couple of different keystrokes on the computer to be able to see the police department's calls. Mr. Kuzins said that he was also able to read all the comments about the rape that had been typed by the dispatcher."
After that incident, Mr. Daley wrote, "Mr. Kuzins said he again told Chief Cole that the [dispatch] system controls needed to be tighter, but again nothing was done about it."
Mr. Daley also looked at a situation that arose from the HIPAA investigation.
The text message that is the subject of the federal complaint shows it was sent from Mr. Polnar's cell phone on Aug. 21.
The man who requested the ambulance was interviewed by Mr. Daley but did not return a call from the Post-Gazette seeking comment. He told the Post-Gazette in October he did not think Mr. Polnar or anyone else who is not a first responder should have received details of his call.
In October, Monroeville police wrote three traffic citations to the resident after he struck a neighbor's mailbox with his car. The resident claims in the Daley report that he never received the citations. Ms. Moy told Mr. Daley that she believes Mr. Cole likely removed them from her filing cabinet.
Mr. Daley could not find the original citations, which disappeared along with the computerized records of the mailbox accident.
Mr. Daley wrote that he "could not establish which person removed or deleted the traffic citation records."
"It is undisputed that only [Mr. Pascarella] and [Mr. Cole] had the ability to delete the computerized record of the traffic charges made against [the resident], however, each of them denied having done so when I interviewed them," Mr. Daley wrote. "Obviously, one of them is not telling the truth, and they both know who that person is."
The Daley report also delves into firefighters' use of generic usernames and passwords to access the dispatch system.
Mr. Daley said in the report that he informed Mr. Cole during the interview that police call entries could be viewed by anyone with the fire companies' generic usernames and passwords.
"Sgt. Cole agreed that firefighters should not have been able to view the police calls, and he told me that if he had known that was happening, he would have done what was necessary to put a stop to it," Mr. Daley wrote.
Mr. Daley reported that Mr. Cole told him that if firefighters were to be assigned individual usernames and passwords instead of generic ones, "it would result in a delayed response time because they would be required to sign onto the computer" before they could view dispatch information.
Tina Mular, Monroeville's former director of technology, told Mr. Daley that firefighters' ability to view police calls "was likely a design problem with the software, rather than someone changing a security setting within the program."
Ms. Mular, who was fired "with cause" in April 2012, wrote in an unpublished letter to the editor that was included in the Daley report that only Mr. Pascarella, not Mr. Cole, had the "superuser" privileges necessary to "make decisions about how the software would operate and who would have access to it."
Mr. Pascarella, Mr. Kuzins, Ms. Moy and municipal manager Lynette McKinney declined to comment on the reports' findings. Ms. Mular could not be reached.
Annie Siebert: [email protected] or 412-263-1613. Twitter: @AnnieSiebert.
Copyright 2013 - Pittsburgh Post-Gazette