Denver pharmacy pays $125,000 to settle HIPAA violations

Cornell Prescription Pharmacy has agreed to pay the federal government $125,000 to settle charges it improperly disposed of the patient information of more than 1,600 people in an unlocked, open container in 2012.

The Denver compounding pharmacy will pay the fine to the U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR). HHS learned of the potential violations of the Health Insurance Portability and Accountability Act (HIPAA) from a television news report. Click here to see that report.

See also: HIPAA in Wonderland

Cornell also agreed to develop and implement a comprehensive set of policies and procedures to comply with HIPAA rules, and to provide staff training.

“Regardless of size, organizations cannot abandon protected health information or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons,” said OCR Director Jocelyn Samuels. “Even in our increasingly electronic world, it is critical that policies and procedures be in place for secure disposal of patient information, whether that information is in electronic form or on paper.”

The patient records were not shredded and contained information that identified specific patients. They were disposed of in an open contained on the pharmacy’s premises. Additionally, the HHS investigation found that Cornell had no written HIPAA policies or procedures.

HHS lists proper methods for disposing protected health information (PHI) on its website. They include:

· Shredding, burning, pulping, or pulverizing paper records for that PHI is unreadable, indecipherable, and cannot be reconstructed

· Keeping labeled prescription bottles and other PHI in opaque bags in a secure area of the pharmacy and using a disposal vender to destroy the PHI

· Clearing, purging, or destroying electronic PHI