Article
Pharmacy to Pay Settlement for Unshredded Medical Records Found in Dumpster
Author(s):
Following a 2012 report of an alleged Health Insurance Portability and Accountability Act violation, a pharmacy in Denver, Colorado, has agreed to pay a $125,000 settlement to the US Department of Health and Human Services.
Following a 2012 report of an alleged Health Insurance Portability and Accountability Act violation, a pharmacy in Denver, Colorado, has agreed to pay a $125,000 settlement to the US Department of Health and Human Services (HHS).
Cornell Pharmacy will also be responsible for instituting a corrective action plan overseen by the HHS.
Tony Jones, the pharmacy’s owner, will develop, revise, and maintain policies that comply with federal standards related to the private health information of patients. The corrective action plan will specifically address “administrative and physical safeguards for the disposal of all non-electronic [protected health information (PHI)],” according to the resolution agreement.
Back in 2012, 9News found unshredded documents containing PHI in an open dumpster owned by Cornell Pharmacy. The news team said it found personal information, including names, prescriptions, and addresses, for around 5000 individuals.
When Cornell heard about the investigation by 9News, it discovered that a “small number of documents” were thrown out before they were shredded, the pharmacy admitted in a statement.
“We believe that those documents were part of the year-end review and purge process of older material,” the statement read. “The failure to shred them was inadvertent.”
Cornell also said the lock to pharmacy’s dumpster was cut off, and the pharmacy had reported it to the police.
“We do not know how 9News obtained the documents, but if they were in plain view when 9News found them, it was because someone had already cut the lock off the dumpster and left the documents behind,” Cornell’s statement read.
However, 9News cited a Waste Management source who said dumpster locks are designed to keep people from adding other trash to the dumpster—not to “secure materials disposed in the containers.”
Cornell said it has reminded its employees about the importance of shredding documents that contain personal information about patients.
9News said it would shred the documents after providing them to the pharmacy so it can contact patients about the potential privacy breach.
