Cornell Prescription Pharmacy has agreed to pay the federal government $125,000 to settle charges it improperly disposed of the patient information of more than 1,600 people in an unlocked, open container in 2012.
The Denver compounding pharmacy will pay the fine to the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). HHS learned of the potential violations of the Health Insurance Portability and Accountability Act (HIPAA) from a television news report. Click here to see that report.
Cornell also agreed to develop and implement a comprehensive set of policies and procedures to comply with HIPAA rules, and to provide staff training.
“Regardless of size, organizations cannot abandon protected health information or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons,” said OCR Director Jocelyn Samuels. “Even in our increasingly electronic world, it is critical that policies and procedures be in place for secure disposal of patient information, whether that information is in electronic form or on paper.”
The patient records were not shredded and contained information that identified specific patients. They were disposed of in an open contained on the pharmacy’s premises. Additionally, the HHS investigation found that Cornell had no written HIPAA policies or procedures.