The way retail pharmacy chains take out their garbage has been cause for privacy concern, but an HHS investigation into Walgreens' garbage disposal has ended without a penalty for the company, reports WTHR.
WTHR started investigating Walgreens' trash disposal policies in 2006. The team found bags full of protected health information in unlocked dumpsters behind "dozens" of stores in Indiana. Such information included names, addresses, phone numbers, medications, physician names and some financial and credit card information.The team then looked at Walgreens stores in other states and found the same practices.
According to WTHR, HHS' Office for Civil Rights was assigned to investigate the case in 2007. Reports indicate OCR confirmed in 2010 that it was looking into it.
OCR recently sent WTHR an email indicating it has closed the investigation into Walgreens after conducting an in-depth compliance review at stores nationwide. The email indicates Walgreens took corrective actions after hearing of WTHR's initial reports, and all dumpsters accessible to the public were locked by November 2006, in addition to other security measures.
"Based on our review of the facts and circumstances of this matter, OCR has determined that all of the issues raised in this matter have now been resolved by voluntary compliance actions of Walgreens," according to the email.
More articles on data breaches:
Banner Health cyberattack brings layered security strategy into focus
Company issuing health plan ID cards hit with data breach affecting 3.3M
Oregon State Hospital reports breach after clinician texts patient medical data