Dive Brief:
- In a medical records dumping case, Parkview Health System, Inc. has agreed to settle HIPAA potential violations with HHS's Office for Civil Rights, HHS said June 23. Parkview, a nonprofit health system based in Fort Wayne, Indiana, serves northeast Indiana and northwest Ohio.
- Parkview will pay $800,000 and adopt a corrective action plan to address deficiencies in its HIPAA compliance program, HHS said. Its plan will include employee training.
- OCR opened an investigation after a retiring physician alleged that Parkview had violated HIPAA. In September 2008, Parkview took custody of paper medical records for roughly 5,000 to 8,000 patients while helping the retiring doctor shift her patients to new providers, and while considering the purchase of some of her practice. In June 2009, Parkview employees, knowing the doctor wasn't home, left 71 cardboard boxes of medical records "unattended and accessible to unauthorized persons on the driveway of the physician’s home, within 20 feet of the public road and a short distance away from a heavily trafficked public shopping venue," HHS said.
Dive Insight:
Experts described the Parkview case as the latest reminder that patient information must be safeguarded regardless of whether it is electronic or paper-based. It's reminiscent of hefty HIPAA penalties imposed on Rite Aid. Corp. and CVS Caremark several years ago for similar cases involving improper disposal of some patients' paper prescription information into dumpsters.
Security consulting firm Redspin CEO Dan Berger told www.govinfosecurity.com that the risk typically is greater when patient information is "concentrated on electronic media," and much of the recent focus has been on electronic health records. "But large numbers of paper records sent to an external shredding company, for example, can also pose a big risk," he said.
According to OCR's latest report to Congress, paper records were involved in 23% of major health data breaches, involving 500 or more individuals, and in 61% of smaller data breaches in 2012.
