Today, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced its Resolution Agreement with Parkview Health System, Inc. (Parkview), a nonprofit health system serving northeast Indiana and northwest Ohio. Parkview agreed to pay $800,000 and implement a Corrective Action Plan.
OCR’s investigation arose out of a retiring physician’s complaint that Parkview violated the HIPAA Privacy Rule by leaving 71 cardboard boxes of medical records on the physician’s driveway when she was not at home. Parkview had taken custody of the records during the course of assisting the physician in transitioning her patients to new providers and of considering whether to purchase some of the physician’s practice. OCR initiated its investigation in 2011, nearly two years after the physician filed her
This settlement is a reminder of the importance of protecting protected health information (PHI) in all forms, whether paper or electronic, at all times. The Corrective Action Plan specifically requires Parkview to revise and maintain written administrative, physical and technical safeguards to protect the privacy of non-electronic PHI, provide training, and report violations of its policies and procedures to OCR.
The press release and the amount of the settlement suggest that OCR’s patience with improper transfer and disposal of PHI may be wearing thin. Christina Heide of OCR noted in the press release that “All too often we receive complaints of records being discarded or transferred in a manner that puts patient information at risk. It is imperative that HIPAA covered entities and their business associates protect patient information during its transfer and disposal.”
The Resolution Agreement, the Corrective Action Plan and OCR’s press release are available at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/parkview.html