The paper record disposal practices of a small pharmacy located in Denver, Colorado violated HIPAA.
The Department of Health and Human Services began investigating the pharmacy after a news station found documents containing protected health information in an open dumpster on the pharmacy’s property. The pharmacy entered into a $125,000 settlement agreement with HHS which included a two year action plan.
The action plan requires the pharmacy to develop written policies and procedures for safeguarding and disposing of PHI. The pharmacy’s workforce must be trained in privacy practices and the employer must set up procedures for internal investigation and sanctions.
All employers should make sure to provide adequate protections to both paper with PHI and electronic PHI.