An Indiana health system was assessed an $800,000 fine for leaving paper patient records on a physician’s driveway. The health system delivered 71 boxes of patient records to the physician’s home. The physician was away at the time of delivery, and the boxes were left unattended and accessible to unauthorized persons.
HIPAA requires covered entities to have proper transfer and disposal policies. Leaving records at an unattended driveway of a home is not a proper policy.