Seventy-one unattended cardboard boxes, sitting unassumingly just 20 feet from a public road, resulted in a HIPAA Privacy rule settlement — including $800,000 in fines — for Fort Wayne, Ind.-based Parkview Health System. The boxes, which contained the medical records of between 5,000 and 8,000 patients, were abandoned in the driveway of a physician's home.
The HHS' Office of Civil Rights opened an investigation into Parkview after receiving a complaint from the retiring physician who found the boxes in her driveway. The Parkview employees who were tasked with assisting the physician in transitioning her patients to new providers left the medical records in plain sight on her property even after receiving notice that she was not home.
"All too often we receive complaints of records being discarded or transferred in a manner that puts patient information at risk," Christina Heide, acting deputy director of health information privacy at OCR, said in a statement. "It is imperative that HIPAA covered entities and their business associates protect patient information during its transfer and disposal."
In addition to the fines, the settlement requires Parkview to take corrective action through staff retraining and policy revision.