Today, the HHS Press office released notice of a settlement of $800,000 with Parkview Health System, Inc. (Parkview) for potential HIPAA violations. This settlement relates to a complaint going back to September 2008, when Parkview received between 5,000-8,000 patient records from a retiring physician. Parkview received the medical records as part of the physician’s transition to retirement, while Parkview decided whether to purchase some of the physician’s practice.
In June, 2009, Parkview employees left 71 cardboard boxes of the records unattended in the driveway of the retired physician’s house when the physician was not home. The driveway was within 20 feet of a public road and close to a heavily trafficked public shopping venue. Parkview is a covered entity under HIPAA, and has duties to safeguard Protected Health Information (PHI) once in its possession through disposal.
While the OCR noted Parkview cooperated with the investigation, Parkview paid $800,000 in resolution, plus entered a corrective action plan requiring revision of its policies and procedures, train staff, and provide an implementation report to the OCR. As covered entities and/or business associates, our healthcare providers must be mindful when disposing of PHI. As Parkview now knows, leaving boxes of PHI in an unattended driveway is not a proper method of disposal.
By Denise Bloch
