The Health Insurance Portability and Accountability Act of 1996 (HIPAA) sets forth certain rules and regulations that healthcare providers have to abide by in order to ensure the confidentiality of patient informations and make sure the necessary information for patient care is given to the correct providers. Parkview Health System, Inc. has agreed to settle potential HIPAA violations costing them around $800,000 dollars after one of their retiring physicians dumped medical records.
“All too often we receive complaints of records being discarded or transferred in a manner that puts patient information at risk,” said Christina Heide, acting deputy director of health information privacy at Dept. of Health and Human Services Office for Civil Rights (OCR), in a press statement. “It is imperative that HIPAA covered entities and their business associates protect patient information during its transfer and disposal.”
The investigation began after receiving a complaint that Parkview had violated the HIPPA privacy rule. Parkview took custody of 5,000 to 8,000 medical records or patients and had allegedly compromised all of them. The incident reportedly occurred back in 2008 when Parkview was assisting a retiring doctor during the transition of her records to the facility. According to the U.S. Department of Health And Human Services, “Parkview employees, with notice that the physician was not at home, left 71 cardboard boxes of these medical records unattended and accessible to unauthorized persons on the driveway of the physician’s home, within 20 feet of the public road and a short distance away from a heavily trafficked public shopping venue.”
The facility in question is a not-for-profit located in Indiana, serving northwest Ohio as well. They have approximately 8,700 employee and have a number of health services including behavioral, cancer, emergency, heart, orthopedics, and women’s health.
Parkview didn’t contest a subsequent investigation with OCR. Along with the $800,000 settlement, the company will also have to implement a corrective action plan. This includes Parkview revising its policies and procedures, and training staff. They will also have to provide an implementation report to OCR.