The associate director of a Harvard teaching hospital said yesterday the procurement of medical records by unauthorized persons is possible, although not widespread.

Geoffrey G. Jackson of Peter Bent Brigham Hospital said while a medical record would not disappear from a hospital floor at Brigham, "a person could come in with a white coat and scan a record at this or any other hospital."

The New York Times said yesterday a Denver-based firm was indicted for stealing medical records and selling them to insurance companies. Agents of the firm used such methods as impersonating doctors to obtain the records, the Times article said.

Jackson said he is confident that such fraud could not happen at Brigham. Regarding hospital security, he said, "It is very tight. In this hospital in particular, I'd say we don't have any leaks in the medical records department."

Jackson called the procedure for the release of medical records "very detailed."

This procedure requires a patient's signed release form and photo identification for the release of records. Lawyers, insurance companies, and other outside parties must also present identification and have the patient's written consent in order to see his records.

If a patient is a minor, or is unable to sign a release statement, his patient or legal guardian is authorized to do so, Jackson said.

Spokesmen from two other Harvard-affiliated hospitals, Massachusetts General and Beth Israel, and the University Health Services said yesterday they maintain similar policies for the release of medical records.

Employees at Massachusetts General, Brigham, and Beth Israel also wear photo identification badges for security reasons. University Health Services employees do not.

"Most employees know the doctors, and we'd ask if he said he was a doctor and we didn't know him," said Carolyn M. Bell, a medical records file clerk at UHS.