Cornell Prescription Pharmacy (“CPP”), a Colorado single-location pharmacy, has agreed to pay $125,000 to the United States Department of Health and Human Services, Office for Civil Rights to settle alleged violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). CPP will also adopt a two-year corrective action plan.
The settlement is the result of an OCR investigation that began in 2012 after OCR received a media report stating that CPP improperly disposed of protected health information (“PHI”) in a dumpster accessible by the public. Documents containing PHI were found in an unlocked open container. They were not shredded. Over 1,600 patients were compromised as a result.
OCR’s investigation revealed that CPP:
-
failed to reasonably safeguard PHI;
-
failed to implement written policies and procedures to comply with the Privacy Rule; and
-
did not provide and did not document training on its Privacy Rule policies and procedures as necessary and appropriate for members of its workforce.
OCR Director, Jocelyn Samuels, reminds entities of the following: “Regardless of size, organizations cannot abandon protected health information or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons.” Further, she stated: “Even in our increasingly electronic world, it is critical that policies and procedures be in place for secure disposal of patient information, whether that information is in electronic form or on papers.”
To read the OCR Bulletin, click here.
To read the Resolution Agreement, click here.
To read FAQs from OCR about HIPAA and the disposal of PHI, click here.
