Case Study: In spring of 2015, Cornell Pharmacy, an independent pharmacy in Denver, was fined $125,000 for HIPAA violations related to improper disposal of PHI. The OCR found that this small health care provider, whose primary customers are hospice care organizations, had failed to establish policies and procedures for PHI disposal. Cornell Pharmacy had improperly disposed the medical records of 1,610 patients by placing them in an open trash container accessible to the public. Furthermore, no training had been provided to the Cornell Pharmacy workforce. In addition to the hefty fine, the pharmacy was required to adopt an action plan, implement HIPAA standards, and provide training to its workforce within 30 days.
Key Takeaway: Having a plan in place is not optional. The plan must outline the policies for HIPAA compliance, and provide guidelines for everyone associated with the covered entity who handles materials with PHI. Even more important, the covered entity must train its workforce to ensure that the plan is executed without fail.
