By Annie Siebert
The Pittsburgh Post-Gazette
MONROEVILLE, Pa. — Monroeville volunteer firefighters and other unauthorized individuals were able to access sensitive information from calls to the municipality’s 911 dispatch center, including details about a rape, according to a confidential report prepared for municipal officials.
The report by a private investigator hired by Monroeville found that while some people were able to access information without authorization, it was not clear whether any federal privacy laws were violated.
John J. Daley, the private investigator who wrote the report, placed ultimate responsibility on police Sgt. Doug Cole, who was demoted from police chief after then-Assistant Chief Steven Pascarella filed a complaint with federal authorities alleging a breach of protected health information.
Sgt. Cole declined to comment on the report, a copy of which was obtained by the Pittsburgh Post-Gazette.
In addition to Sgt. Cole’s demotion, the controversy has led to federal and internal investigations and a shake-up of Monroeville council.
Attorneys with Dickie, McCamey & Chilcote, a Downtown law firm the municipality hired to investigate, last week sent the U.S. Department of Health and Human Services a packet of documents compiled by private and forensic investigators that detail how 911 dispatch information was managed in Monroeville.
Mr. Daley’s report was distributed to elected officials July 2. Among its findings:
—Monroeville 911 records — including names, addresses and medical information — were available to unauthorized people from August 2010 through February 2013.
—There was no protocol in place to remove former or inactive emergency responders from the list of people receiving 911 dispatch data.
—Curious volunteer firefighters were able to access police call information, sometimes after hearing calls on the police radio.
—Firefighters on one occasion reportedly reviewed police 911 information about a rape case.
—Members of the police and fire departments appear to have violated the municipality’s employee handbook regarding computer usage.
—Sgt. Cole was repeatedly warned about potential problems with access to dispatch data, but said in interviews with investigators that he did not recall such issues being brought to his attention.
Mr. Daley said Sgt. Cole was “ultimately responsible” for protecting the data from the computer systems in the 911 center, adding that he should have heeded the warnings of Chief Pascarella and Monroeville Volunteer Fire Co. No. 5 president Kenneth Kuzins, who recommended restrictions on access to dispatch information.
The municipality has been embroiled in controversy since August, when Chief Pascarella filed a complaint with the Department of Health and Human Services’ Office of Civil Rights alleging a breach of the Health Insurance Portability and Accountability Act. The department will ultimately determine whether Monroeville violated the law.
That complaint was sparked by a text message sent by retired Monroeville police Chief George Polnar, now manager of security and parking at UPMC East, to Linda Moy, the police chief’s secretary.
The text contained the address, age and medical condition of a Monroeville resident who lives on Ms. Moy’s street and requested an ambulance. Ms. Moy showed the text to Chief Pascarella, who recognized it as a dispatch report only current emergency responders should have had access to. Mr. Polnar retired as police chief in January 2010. Mr. Daley wrote that Mr. Polnar declined to be interviewed as part of the investigation.
In the Daley report, Chief Pascarella said he repeatedly told Sgt. Cole about unauthorized users having access to the municipality’s 911 dispatches, but no action was taken. Chief Pascarella told Mr. Daley that he filed a federal complaint because his job would be protected by whistle-blower laws.
Since then, the municipality has split into two camps — one supporting Chief Pascarella and his accusations, and the other rallying behind Sgt. Cole.
Mr. Kuzins, who is also an employee in Monroeville’s public works department, told Mr. Daley that he, too, warned Sgt. Cole about unauthorized access to the dispatch center.
Mr. Kuzins told Mr. Daley he was at the Monroeville Volunteer Fire Co. No. 5 in winter 2011 or early spring 2012 when he heard firefighters talking about a rape and “saw that the [dispatch] entry regarding the rape was displayed on the computer terminal in the fire station’s kitchen area.”
“The firefighter then demonstrated to Mr. Kuzins how he could use a couple of different keystrokes on the computer to be able to see the police department’s calls,” Mr. Daley wrote.
After that incident, he wrote, “Mr. Kuzins said he again told [then] Chief Cole that the [dispatch] system controls needed to be tighter, but again nothing was done about it.”
Mr. Daley also looked at a situation that arose from the HIPAA investigation.
The text message that is the subject of the federal complaint shows it was sent from Mr. Polnar’s cell phone Aug. 21.
The man who requested the ambulance was interviewed by Mr. Daley but did not return a call from the Post-Gazette seeking comment. He told the Post-Gazette in October he did not believe anyone who is not a first responder should have received details of his call.
In October, Monroeville police wrote three traffic citations to the resident after he struck a neighbor’s mailbox with his car. The resident claims in the Daley report that he never received the citations. Ms. Moy told Mr. Daley that she believes Sgt. Cole likely removed them from her filing cabinet.
Mr. Daley could not find the original citations, which disappeared along with the records of the mailbox accident.
Mr. Daley wrote that he “could not establish which person removed or deleted the traffic citation records.”
“It is undisputed that only [Chief Pascarella] and [Sgt. Cole] had the ability to delete the computerized record of the traffic charges made against [the resident], however, each of them denied having done so when I interviewed them,” Mr. Daley wrote.
The Daley report also delves into firefighters’ use of generic usernames and passwords to access the dispatch system.
Mr. Daley said in the report that he informed Sgt. Cole during the interview that police call entries could be viewed by anyone with the fire companies’ generic usernames and passwords.
“Sgt. Cole agreed that firefighters should not have been able to view the police calls, and he told me that if he had known that was happening, he would have done what was necessary to put a stop to it,” Mr. Daley wrote.
Mr. Daley reported that Sgt. Cole told him that if firefighters were to be assigned individual usernames and passwords instead of generic ones, “it would result in a delayed response time because they would be required to sign onto the computer” before they could view dispatch information.
Tina Mular, Monroeville’s former director of technology, told Mr. Daley that firefighters’ ability to view police calls “was likely a design problem with the software, rather than someone changing a security setting within the program.”
Ms. Mular, who was fired “with cause” in April 2012, wrote in an unpublished letter to the editor that was included in the Daley report that only Chief Pascarella had the privileges necessary to “make decisions about how the software would operate and who would have access to it.”
Chief Pascarella, Mr. Kuzins, Ms. Moy and municipal manager Lynette McKinney declined to comment on the reports’ findings. Ms. Mular could not be reached.
___
(c)2013 the Pittsburgh Post-Gazette
Distributed by MCT Information Services