A tip from a local Denver news outlet lead to a compliance review, investigation and ultimately a resolution agreement between the Department of Health and Human Services\u2019 Office for Civil Rights (\u201cOCR\u201d) and Denver-based Cornell Prescription Pharmacy (\u201cCPP\u201d). On January 11, 2012, 9 News, the Denver NBC news affiliate, reported to OCR that certain patient information was being disposed of in a dumpster that was accessible to the public. The Health Insurance Portability and Accountability Act of 1996 (\u201cHIPAA\u201d) is the primary Federal regulation governing the security and privacy of certain personally identifiable health information or \u201cPHI.\u201d Under HIPAA\u2019s Privacy Rule, pharmacies such as CPP are required to implement appropriate administrative, technical and physical safeguards to protect the privacy of PHI, in any form. See 45 CFR 164.530(c). The disposal of paper records containing PHI in a publicly-accessible dumpster is, of course, unreasonable by any measure.<\/p>\n\n\n\n
Just two<\/em> days after receiving the report, OCR initiated a compliance review and investigation of CPP. OCR\u2019s investigation found that CPP had failed to:<\/p>\n\n\n\n Under the terms of the resolution agreement (a copy of which can be found\u00a0here<\/a>), CPP is required\u00a0to pay HHS $125,000 and agree to a corrective action plan (\u201cCAP\u201d). CPP\u00a0will not be required to admit wrongdoing under the terms of the resolution agreement. Under the CAP, CPP is required to develop\u00a0written policies and procedures to comply with HIPAA, provide those policies and procedures to HHS by May 22, 2015, and implement said procedures within 30 days of receiving HHS\u2019 final approval.\u00a0\u00a0CPP is also required to produce an implementation report as well as annual reports for the next two years.<\/p>\n\n\n\n \u201cRegardless of size, organizations cannot abandon protected health information or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons,\u201d said OCR Director Jocelyn Samuels. \u201cEven in our increasingly electronic world, it is critical that policies and procedures be in place for secure disposal of patient information, whether that information is in electronic form or on paper.\u201d<\/p>\n\n\n\n While not as easily transferable as its digital counterpart, the information in paper-based medical records remains extremely lucrative in the black market. It has been\u00a0estimated that your medical data\u00a0can fetch as much as 10 times the value<\/a>\u00a0of your credit card number. Understandably, health care providers and others covered by HIPAA will face increasing scrutiny given this lucrative black market as well as the recent high profile breaches at various health insurance companies across the United States. Notwithstanding\u00a0a recent delay<\/a>, OCR is planning to conduct a new round of audits to prevent the situations discussed above.\u00a0\u201cWe are committed to implementing a robust audit program,\u201d Samuels said. \u201d I can\u2019t promise you the specific date, but it\u2019s happening.\u201d\u00a0As OCR readies its Phase II audit program, regulated entities can be assured that NBC news and others, will be watching for evidence of non-compliance.<\/p>\n","protected":false},"excerpt":{"rendered":" A tip from a local Denver news outlet lead to a compliance review, investigation and ultimately a resolution agreement between the Department of Health and Human Services\u2019 Office for Civil Rights (\u201cOCR\u201d) and Denver-based Cornell Prescription Pharmacy (\u201cCPP\u201d). On January 11, 2012, 9 News, the Denver NBC news affiliate, reported to OCR that certain patient information was being disposed … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_generate-full-width-content":"","footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4551"}],"collection":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/comments?post=4551"}],"version-history":[{"count":2,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4551\/revisions"}],"predecessor-version":[{"id":4553,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4551\/revisions\/4553"}],"wp:attachment":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/media?parent=4551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/categories?post=4551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/tags?post=4551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}