Health plans and insurers, health care providers, health care clearinghouses (“Covered Entities”), their business associate service providers, leaders and insurers should re-confirm their own organizations’ for handling and disposing of records and systems containing protected health information (“PHI”) comply with the Health Care Portability & Accountability Act (“HIPAA”) following the Department of Health & Human Services Office for Civil Rights (OCR) announcement yet another HIPAA enforcement action and settlement arising from improper PHI disposal.
OCR’s $300,000 plus settlement with New England Dermatology P.C., d/b/a New England Dermatology and Laser Center (“NDELC”) announced last week resolves OCR charges that NDELC violated the HIPAA Privacy Rules when it placed specimen containers with patient identifying PHI in its parking lot garbage bin.
OCR Long Enforced HIPAA PHI Disposal Responsibilities
OCR has long interpreted and enforced HIPAA as requiring Covered Entities and business associates to ensure appropriate processes are used to protect PHI when that safeguards are in place when disposing of patient information to keep it from being accessible by the public. ”Improper disposal of protected health information creates an unnecessary risk to patient privacy,” said Acting OCR Director Melanie Fontes Rainer.
The NEDLC enforcement action and NEDLC Resolution Agreement follow prior OCR settlements and warnings to Covered Entities and business associates about their responsibility to protect PHI through proper disposal during their ongoing operations as well as when closing operations.
Past OCR enforcement actions and settlements demonstrated OCR’s readiness to hold Covered Entities and their business associates accountable for properly disposing of records and materials containing PHI, In 2015, for instance, Cornell Prescription Pharmacy paid OCR $125,000 and implemented a correction action plan to correct alleged HIPAA violations after an OCR investigation of a local news report confirmed unsecured paper documents containing PHI of more than 1600 patients were disposed of in an unlocked, open container on Cornell’s premises. The documents were not shredded and contained identifiable information regarding specific patients. See Cornell Prescription Pharmacy Resolution Agreement. See also $800,000 HIPAA Settlement in Medical Records Dumping Case.
Other OCR enforcement actions highlighted the responsibility of Covered Entities and business associates to protect PHI when disposing of computer or other devices. For instance, OCR collected $1,215,780.00 from Affinity Health to settle potential HIPAA Civil Monetary Sanctions after OCR found it exposed the PHI of up to 344,579 individuals by returning photocopiers to a leasing agent without erasing the data contained on the copier hard drives. Affinity Health Plan, Inc. Resolution Agreement.
The OCR guidance and enforcement actions also make clear that the obligation for proper protection and disposal continues through termination of the business or operations through which a Covered Entity or business associate possessed or retained PHI. Thus, in the FileFax Resolution Agreement, for instance the receiver appointed to liquidate the assets of FileFax, Inc. paid $100,000 out of the receivership estate to OCR to settle potential HIPAA violations after Filefax shut its doors during the course of OCR’s investigation into alleged HIPAA violations.
New $300,000+ NEDLC Settlement Agreement
The NEDLC investigation and resulting settlement reflect OCR’s continued concern about ensuring appropriate protection of PHI through disposal. On May 11, 2021, NEDLC filed a breach report with OCR that reported empty specimen containers with the PHI on labels were placed in a garbage bin in their parking lot. The containers’ labels included patient names and dates of birth, dates of sample collection, and name of the provider who took the specimen. On March 31, 2021, a third-party security guard found one specimen container bearing a label containing patient names, dates of birth, dates of sample collection, and name of the provider who took the specimen. During the investigation, NEDLC stated that from February 4, 2011 until March 31, 2021, it regularly discarded specimen containers with an attached label that contained PHI as regular waste, bagged and placed in an exterior dumpster accessible via the parking lot, without alteration to the PHI containing label.
OCR’s New England Regional Office found the practice of disposing of specimen containers with their labels containing PHI violated the HIPAA Privacy Rule including the impermissible use and disclosure of PHI and failure to maintain appropriate safeguards to protect the privacy of PHI.
Under the NEDLC Resolution Agreement, NEDLC paid $300,640 to OCR and agreed to implement a “robust” corrective action plan that includes two years of OCR monitoring to settle OCR’s charges that it breached HIPAA by failing to appropriately secure and protect PHI through disposal. Among other things, the corrective action plan requires NEDLC to:
- Within 60 days, develop, maintain, and revise, as needed and present for OCR review its written policies and procedures to comply with the physical safeguard and disposal of PHI created, received or maintained by or on behalf of NEDLC and all other HIPAA Privacy, Security and Breach Notification and training protocols to ensure workforce member compliance with these policies; and sanctions for workforce members violating these requirements;
- Implement the updated policies and procedures within 30 days of receipt of HHS approval;
- Distribute the policies to existing members of its workforce within 30 days of receipt of HHS approval of the policies and subsequently to new members of the workforce within 30 days of their beginning of service and obtain a signed written or electronic initial compliance certification from all members of the workforce and relevant business associates stating that the workforce members have read, understand, and shall abide by such policies and procedures;
- Assess, update, and revise, as necessary, the policies and procedures at least annually or as needed, provide the revised policies and procedures to HHS for review and approval, and redistribute to and obtained new compliance certifications from workforce members and business associates within 30 days of HHS approval;
- If it receives information during the Compliance Term that a workforce member or business associate may have failed to comply with its policies and procedures for safeguarding PHI, promptly investigate and it the investigation finds a violation, notify HHS within 30 days of the violation and corrective action taken;
- Comply with specified breach investigation and notification requirements;
- Provide reports certified by a designated leader of the organization its implementation of the corrective action plan, annually and upon the occurrence of certain other events during the two-year monitoring period.
Take Aways From NEDLC And Other OCR Improper Disposal Enforcement
As the NEDLC and other settlements make clear, Covered Entities and business associates are accountable for recognizing and protecting all PHI in the various phases of its lifecycle in the organization including when it is being disposed or migrating through various systems. Existing OCR enforcement actions like the NECLC Settlement Agreement highlight the need for other Covered Entities and their business associates to ensure all necessary steps are taken to protect PHI when disposing of any items, devices and data containing PHI from patient labeled items including identification bracelets, medication containers and labels, meal trays, folders, tags, storage containers, computers, copiers, jump drives and other electronic storage or other devices and plethora of other items. The announcement of the NEDLC settlement signals the advisability for Covered Entities and their business associates to reassess and reconfirm the adequacy of their own disposal processes and documentation.
Security and disposal practices and procedures are among the elements of HIPAA compliance that OCR expects Covered Entities to address in the documented risk assessments the regulations require Covered Entities to prepare and maintain. See $750,000 HIPAA Settlement Underscores the Need for Organization Wide Risk Analysis. As with other HIPAA compliance responsibilities, OCR regulations require that Covered Entities include their documented assessment and decision-making about the adequacy and reasonableness of their PHI protection and destruction practices under HIPAA as part of their overall HIPAA risk assessment plan and practices. The documented risk assessment requirements make it ill-advised for Covered Entities or business associates to assume their disposal or other HIPAA compliance obligations are satisfied by their past or current adoption of a standard set of policies and procedures obtained from a third-party.
When reviewing the adequacy of their organizations’ PHI disposal practices, Covered Entities and business associates should keep in mind OCR’s HIPAA regulations require them to document risk assessments, analysis, findings and actions as well as recurrently update this analysis periodically and at other times when warranted by events or developments putting the organizations on notice of potential concerns. These risk assessment requirements expect Covered Entities and business associates to conduct documented reviews and risk assessments “of their own circumstances to determine what steps are reasonable to safeguard PHI through disposal and develop and implement policies and procedures to carry out those steps” considering such issues as the form, type, and amount of PHI to be disposed. Covered entities are responsible for conducting and documenting their analysis as well as their adoption, implementation and enforcement of the resulting policies and procedures. HIPAA’s six-year record retention requirements extend to creation and preservation of the risk assessment documentation by a Covered Entity or business associate and OCR commonly asks for these assessment when initiating an audit or investigation. Accordingly, while organizations should consider examples discussed in OCR’s PHI destruction guidance when conducting their own risk announcement, each Covered Entity or business associate should resist the temptation of assuming reliance upon those examples is an adequate substitute for conducting and documenting their own specific risk assessment and analysis.
Best practices require tracking of all elements of PHI created, used, accessed, disclosed, or disposed of all times through documented, appropriate destruction. Ensuring proper fulfillment of these requirements necessitates that these policies and practices cover both disposition or destruction as part of continuing operations as well as required safeguards for disposal or destruction when a Covered Entity or business associate shuts down, sells or otherwise terminates operations that possess or have had access to PHI.
Of course, Covered Entities, business associates, their leaders and liability insurers also should remain mindful that their likely responsibilities and potential liability for mishandling PHI generally also runs concurrent with other contractual, statutory, regulatory or common law exposures. For instance, as HIPAA compliance is part of the Conditions of Participation that Medicare participating Covered Entities and Medicare Advantage Plans must meet to qualify for program participation, noncompliance could trigger program exclusion, False Claims Act or related exposures. Deficiencies in security or destruction of credit card, banking or other PHI that also qualifies as personal financial information could trigger exposure under Federal Trade Commission, state identity theft and privacy or other laws. Public companies and their leaders also may need to evaluate if deficiencies in their security or destruction protocols trigger investor disclosure obligations under Securities and Exchange Commission rules or other federal or state laws. Considering these and other exposures, documented, compliance and defensibility of PHI and other sensitive information use, protection, disclosure and destruction should rank high among the priorities of all Covered Entities and their leaders.
Since these evaluations could uncover or involve discussions of past or ongoing known or potential compliance concerns, Covered Entities and business associates should consider engaging legal counsel experienced with compliance and risk management under HIPAA and other implicated legal risks to advise and aid the Covered Entity to structure, conduct, evaluate findings and determine and implement any corrective actions that the review reveals as required or advisable within the scope of attorney client privilege. If circumstances come to light that indicate a breach of the standards in the course of the disposal compliance assessment or otherwise, Covered Entities also promptly should work with legal counsel timely to investigate, determine and provide any required notifications or other corrective action and document their actions to meet applicable HIPAA and other legal obligations and mitigate liability.
More Information
We hope this update is helpful. For more information about the these or other health or other legal, management or public policy developments, please contact the author Cynthia Marcotte Stamer via e-mail or via telephone at (214) 452 -8297.
Solutions Law Press, Inc. invites you receive future updates by registering on our Solutions Law Press, Inc. Website and participating and contributing to the discussions in our Solutions Law Press, Inc. LinkedIn SLP Health Care Risk Management & Operations Group, HR & Benefits Update Compliance Group, and/or Coalition for Responsible Health Care Policy.
About the Author
Recognized by her peers as a Martindale-Hubble “AV-Preeminent” (Top 1%) and “Top Rated Lawyer” with special recognition LexisNexis® Martindale-Hubbell® as “LEGAL LEADER™ Texas Top Rated Lawyer” in Health Care Law and Labor and Employment Law; as among the “Best Lawyers In Dallas” for her work in the fields of “Labor & Employment,” “Tax: ERISA & Employee Benefits,” “Health Care” and “Business and Commercial Law” by D Magazine, Cynthia Marcotte Stamer is a practicing attorney board certified in labor and employment law by the Texas Board of Legal Specialization and management consultant, author, public policy advocate and lecturer widely known for 30+ years of health industry and other management work, public policy leadership and advocacy, coaching, teachings, and publications.
A Fellow in the American College of Employee Benefit Counsel, Vice Chair of the American Bar Association (“ABA”) International Section Life Sciences and Health Committee, Past Chair of the ABA Managed Care & Insurance Interest Group, Scribe for the ABA JCEB Annual Agency Meeting with HHS-OCR, past chair of the ABA RPTE Employee Benefits & Other Compensation Group and current co-Chair of its Welfare Benefit Committee, Ms. Stamer is most widely recognized for her decades of pragmatic, leading edge work, scholarship and thought leadership on health and managed care industry legal, public policy and operational concerns.
Ms. Stamer’s work throughout her 30 plus year career has focused heavily on working with health care and managed care, health and other employee benefit plan, insurance and financial services and other public and private organizations and their technology, data, and other service providers and advisors domestically and internationally with legal and operational compliance and risk management, performance and workforce management, regulatory and public policy and other legal and operational concerns.
For more information about Ms. Stamer or her health industry and other experience and involvements, see www.cynthiastamer.com or contact Ms. Stamer via telephone at (214) 452-8297 or via e-mail here.
About Solutions Law Press, Inc.™
Solutions Law Press, Inc.™ provides human resources and employee benefit and other business risk management, legal compliance, management effectiveness and other coaching, tools and other resources, training and education on leadership, governance, human resources, employee benefits, data security and privacy, insurance, health care and other key compliance, risk management, internal controls and operational concerns. If you find this of interest, you also be interested reviewing some of our other Solutions Law Press, Inc.™ resources available here.
IMPORTANT NOTICE ABOUT THIS COMMUNICATION
If you or someone else you know would like to receive future updates about developments on these and other concerns, please be sure that we have your current contact information including your preferred e-mail by creating your profile here.
NOTICE: These statements and materials are for general informational and purposes only. They do not establish an attorney-client relationship, are not legal advice or an offer or commitment to provide legal advice, and do not serve as a substitute for legal advice. Readers are urged to engage competent legal counsel for consultation and representation considering the specific facts and circumstances presented in their unique circumstance at any particular time. No comment or statement in this publication is to be construed as legal advice or an admission. The author and Solutions Law Press, Inc.™ reserve the right to qualify or retract any of these statements at any time. Likewise, the content is not tailored to any particular situation and does not necessarily address all relevant issues. Because the law is rapidly evolving and rapidly evolving rules makes it highly likely that subsequent developments could impact the currency and completeness of this discussion. The author and Solutions Law Press, Inc.™ disclaim, and have no responsibility to provide any update or otherwise notify anyone any such change, limitation, or other condition that might affect the suitability of reliance upon these materials or information otherwise conveyed in connection with this program. Readers may not rely upon, are solely responsible for, and assume the risk and all liabilities resulting from their use of this publication. Readers acknowledge and agree to the conditions of this Notice as a condition of their access of this publication.
Circular 230 Compliance. The following disclaimer is included to ensure that we comply with U.S. Treasury Department Regulations. Any statements contained herein are not intended or written by the writer to be used, and nothing contained herein can be used by you or any other person, for the purpose of (1) avoiding penalties that may be imposed under federal tax law, or (2) promoting, marketing or recommending to another party any tax-related transaction or matter addressed herein.
©2022 Cynthia Marcotte Stamer. Limited non-exclusive right to republish granted to Solutions Law Press, Inc.™
slphrbenefitsupdate.com 