Marcum LLP
Insights

Healthcare Alert

 

In This Edition

HIPAA Settlement Highlights the Continuing Importance of Secure Disposal of Paper Medical Records

Share:

HIPAA compliance is getting down to the weeds. Even a "small" pharmacy that made a blunder is in the scope of the HIPAA police- inadvertent and accidental disposal of documents with PHI (Personal Health Information) will get you in big trouble Make sure you have a good security program for both paper and electronic documents, or ask us to help you design one.

Cornell Prescription Pharmacy (Cornell) has agreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule with the Department of Health and Human Services (HHS), Office for Civil Rights (OCR). Cornell will pay $125,000 and adopt a corrective action plan to correct deficiencies in its HIPAA compliance program. Cornell is a small, single-location pharmacy that provides in-store and prescription services to patients in the Denver, Colorado metropolitan area, specializing in compounded medications and services for hospice care agencies in the area.

OCR opened a compliance review and investigation after receiving notification from a local Denver news outlet regarding the disposal of unsecured documents containing the protected health information (PHI) of 1,610 patients in an unlocked, open container on Cornell's premises. The documents were not shredded and contained identifiable information regarding specific patients. Evidence obtained by OCR during its investigation revealed Cornell's failure to implement any written policies and procedures as required by the HIPAA Privacy Rule. Cornell also failed to provide training on policies and procedures to its workforce as required by the Privacy Rule.

"Regardless of size, organizations cannot abandon protected health information or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons," said OCR Director Jocelyn Samuels. "Even in our increasingly electronic world, it is critical that policies and procedures be in place for secure disposal of patient information, whether that information is in electronic form or on paper."

In addition to the $125,000 settlement amount, the agreement requires Cornell to develop and implement a comprehensive set of policies and procedures to comply with the Privacy Rule, and develop and provide staff training. The Resolution Agreement can be found on the OCR website at: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/cornell.html

OCR offers helpful FAQs concerning HIPAA and the disposal of protected health information: http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/disposalfaqs.pdf

To learn more about non-discrimination and health information privacy laws, your civil rights, and privacy rights in health care and human service settings, and to find information on filing a complaint, visit us at http://www.hhs.gov/ocr/office

 
 
 
 
HAVE A QUESTION? ASK MARCUM
 
STAY IN TOUCH.

SIGN UP TODAY FOR MARCUM'S NEWSLETTERS.

ABOUT MARCUM LLP

Marcum LLP is one of the largest independent public accounting and advisory services firms in the nation, with offices in major business markets throughout the U.S., as well as Grand Cayman, China and Ireland.

Learn More

CONNECT WITH US
OFFICES

Headquarters
750 3rd Avenue, 11th Floor
New York, NY 10017

Find an Office

(855) MARCUM1
info@marcumllp.com

FOUNDATION

Marcum Foundation

AFFILIATIONS

Leading Edge Alliance

Privacy Policy

This website uses cookies to learn how visitors interact with our website so that we can improve our services and your online experience. By using this website, you agree to our privacy policy.