A Denver news outlet recently notified the Office of Civil Rights (OCR) about the disposal of unsecured documents containing the protected health information (PHI) of 1,610 patients in an unlocked, open container on the premises of Cornell Prescription Pharmacy (Cornell).
The documents were not shredded and contained identifiable information regarding specific patients. Cornell is a small, single location pharmacy that provides prescription services and specializes in compounding medications and services for hospice care agencies.
The investigation by the OCR revealed that Cornell failed to implement any written policies and procedures for the disposal of PHI as required by HIPAA. Additionally, Cornell did not train staff on policies and procedures as required by the Privacy Rule.
Cornell agreed to settle the violation, pay $125,000, and implement a plan to correct the deficiencies. The agreement also requires Cornell to develop and implement a comprehensive set of policies and procedures and a plan for staff training.
The important message for all physicians -- solo, small or large practice -- is in a quote from OCR Director Jocelyn Samuels that states:
"Regardless of size, organizations cannot abandon protected health information or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons... Even in our increasingly electronic world, it is critical that policies and procedures be in place for secure disposal of patient information, whether that information is in electronic form or on paper."
For more information about the disposal of PHI, go to the HHS/OCR website and download the Frequently Asked Question About Disposal of Protected Health Information.
Authored by
Ann Whitehead, JD, RN
Vice President, CAP Risk Management & Patient Safety
If you have questions about this article, please contact us. This information should not be considered legal advice applicable to a specific situation. Legal guidance for individual matters should be obtained from a retained attorney.