Improper Medical Records Disposal Results in Substantial HIPAA Penalty
In late June Parkway Physicians Group, a large multi-specialty medical group with offices in northeast Indiana and northwest Ohio, entered in to a Resolution Agreement with the United States Department of Health and Human Services, Office of Civil Rights (OCR) to settle violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Under that agreement Parkway agreed to pay an $800,000 penalty; adopt a corrective action plan to address deficiencies in its HIPAA compliance plan; train its staff in HIPAA compliance; and provide an implementation report to OCR.
OCR began its investigation after receiving a complaint of a HIPAA violation from a retired Parkview physician. While assisting the retired physician in transitioning her patients to new providers, Parkview took custody of medical records pertaining to approximately 5,000 to 8,000 of her former patients that contained protected health information (PHI) in non-electronic form. About nine months later Parkview employees, with knowledge that the retired physician was not at home, left 71 cardboard boxes containing those medical records on the driveway of her home, unattended and accessible to unauthorized persons. The records were left within 20 feet of the public road and a short distance from a heavily trafficked public shopping area.
“All too often we receive complaints of records being discarded or transferred in a manner that puts patient information at risk,” said Christina Heide, acting deputy director of health information privacy at OCR. “It is imperative that HIPAA covered entities and their business associates protect patient information during its transfer and disposal.”
Although the facts of the Parkview case appear outrageous, that case is an important lesson to all health care providers that the improper transfer or disposal of medical records containing PHI can lead to a substantial HIPAA penalty.