An Indiana community health system has agreed to an $800,000 settlement for potential HIPAA violations involving paper-based medical records. The incident serves as the latest reminder that sensitive information, whether electronic or paper-based, must be protected.
The potential breaches occurred in 2009 when the health system was helping a retiring physician transition her patients to new providers. Employees of the health system left boxes that contained 8,000 patients’ medical records unattended on the physician’s driveway. In doing so, they made the patients’ PHI accessible without authorization despite knowing that the physician was not home at the time.
In addition to the $800,000 payment, the settlement requires the health system to provide safeguards training for all employees who have access to PHI.
Benefit Allocation Systems, Inc. has implemented comprehensive security measures to protect all sensitive client information, including paper-based information. As described here, all paper with PHI is shredded or retained in BAS’ secure offices. Additionally, all employees receive HIPAA training at the time of hire, as well as participate in annual “refresher” trainings, so that they can properly handle all sensitive information.
